I 



A 



REF ID : A4148948 ' m 

•C ^33 



& 



k 



i 



L 



GEIITO 




EO 3.3(h)(2) 

PL 86-36/50 USC 3605 



0 F 



EO 3.3(h)(2) 

PL 86-36/50 USC 3605 




Being a personal account of a cryptanalytic 
challe nge whic h involved a system very simi- 
lar to I I and which was successfully met 

before the dawn of the machine age. 






By 

William F. Friedman 



Qy6^AJL^> - / 

zJt Tt^A-r^- & 



3 



_ Cf £? CL. 

<yy^( H ® 

- /^ 9. 3 ", 



21 July 1948 





( 



REF ID : A4148948 



3.3(h)(2) 

PL 86-36/50 USC 3605 



FOREWORD 



In one respect, the classification of this FOREWORD and of th© 
accompanying papers is a rather remarkable anomaly and one . that may 
be of interest. <; I shall begin the story by noting that when cor- 
rectly used, thg, currently employed \ l is, cryptographic- 

ally, almost anifezact replica of a system developed over 30 years 
ago by ^he American Telephone ©ad Telegraph Company, for the U. S. 
Army in World Wsjfe I. A rather detailed description of the system 
and its apparatus® ms disclosed by the American Telephone and 
Telegraph Company in a technical paper which was written by th© 
principal inventor, an A. T. & T. Co. engineer named -Verna®, and 
which he presented before th© midwinter convention of the American 
Institute of Eledtrical Engineers at Rev York City in February 
1926. The Yernam paper was later printed in the proceedings of th© 
Institute, It see ms almos t a certainty that the cryptographic 



principles on which 



is based stem directly from that paper. 



Our records show that the A. T. & T. Co. development was x 
Initiated in 1916, but was perfected too lat© to have been employed 
extensively for II. S. Amy traffic in World War I. A set of four 
intercoKiunlcatlng stations was established in the autumn of 1918, 
priiaarily for test purposes in the United States, 2 and a' limited 
amount of actual traffic was handled in this system as a preliminary 
to possible wider usage by the U. S. Army/ both in the United States 
and in Europe In 1918. In the spring of 1919, upon the close of 
World War I and for a ijiumber of reasons, one of which will soon b© 
made clear,' the system was abandoned. Some 22 years later, in the 
face of a real need for secure teletypewriter communications and 
while awaiting the completion of new equipment specially designed 
for the purpose, I suggested that the old "double-tape system” be 
resuscitated by th«^ Signal Corps as an emergency means of teletype- 
writer crypto -coiswuni cation. The A. T. & T. Co. was very helpful 
in this and th© emergency system was successfully used from the 
middle of 1942 until early in 1943/ when it was replaced by better 
ones using more modern equipment. 



* * » * a •& 



It was the contention of all concerned in the original A. T. & T. 
Co. development in World War I —the engineers of the company and 
those of the Signal Corps, as well as the cryptanalysts in the 
Military Intelligence Division, General Staff, in Washington— -that 
the system and apparatus as developed and proposed for use was 
"absolutely indecipherable without th© keys." Indeed, the Director 
of the Military Intelligence Division went on record officially to 
that effect and a copy of the letter, which was actually prepared 
by Yardley (author of "The American Black Chamber”), is still av&il- 
, able in our files . 



^Vernam, G. S., Cipher Printing Telegraph Systems for Secret Wls»e 
and Radio Telegraphic Communications, Trans. Vol. 45, 

pp. 109-15, 192,6. (Vernam is the man whose name gave rise to the 
rule which w© now call "Vernam addition.”) 

2 A document dated 23 S8pt. 1918 entitled "Regulations for the Test 
of the Printing Telegraph Cipher” is still extant. 



- 1 - 



erss 

. ■ r 


0 


01 g 


ff 


m 


^ae 


P 

JM 5 T ' 


1 


y 


J m 


I EL 




H 

fl 

lbs 


jMLm I 



I 



REF ID : A4 148^,8^ 3 (h)( 2 ) 



/ 



PL 86-36/50 USC 3605 



Of possible interest to the reader are the circumstances tinder 
which the apparatus and the systems were explained to me in lew 
York, in the early part of May 1918, as 1 was about to embark for 
war service in the Code and Cipher Solution Section, of G-2, GHQ -ASF , 
in Prance. Fro® the summer of 1915 until May 1918, I had been a 
member of the s^taff of an Institution known as .the River bank Labora- 
tories at Geneva, Illinois, a private research organisation operated 
by a somewhat c f ecentric but wealthy Chicagoan named Colonel George 
Fsbyan.l One of the fields in which research was conducted at th© 
Riverbank Laboratories by a small staff was that of cryptography, a 
subject in which I took an interest as an avocation. But soon it 
became my vocation, when in the latter part of 1916 Colonel Pabyan 
made me Director of the Department of Ciphers in addition to certain 
other duties. From then until about the middle of 1918 , in a quasi - 
official relationship with, and at no expense whatever to. the 
Government (Colonel F&byan, as a patriotic citizen, footed all the 
bills), the Department of Ciphers conducted cryptanalytic work for 
the State, Var, Navy, and Justice Departments. None of these 
large organizations had any cryptanalytic units whatever until the 
Army established a unit (under Yardley) in the latter part of 1917. 
It was on the basis of this earlier quasi -official relationship 
that a disclosure of the details of the A. T. & T. cipher machine 
and its operation was made to Colonel Pabyan and to me in May 1918, 
as noted. (Security considerations were just in their infancy. 8 ) 

* * 

As explained to us by. the officials of the A. T. & T. Co., 
the cryptographic system th ey proposed was based upon the us© of 
two "Baudot random-key tapes f 



one exactly 1000, the other, exactly 999 characters m 
length; 1 both were to be .changed daily. Single tapes were never to 
be used -“-always both tapes were to foe employed simultaneously, in 
combination, to generate by their interaction a single very long 
key of 999*000 characters. 



I heard nothing more about this machine until April 1919, 
when I was demobilized and rejoined the staff at the- Riverbank 
Laboratories, to resume my position as head of the Department of 
Ciphers— with no other duties/ The A. T. & T. cipher was then 
being carefully scrutinized by my staff. 

Having had a good opportunity to study the system, the conten- 
tion of invulnerability to decipherment without the key (the word 
cryptanalysis had not as yet been coined) was deemed to be unwar- 
ranted by the cryptanalytic staff at Riverbank. After noting the 
results of their theoretical studies and elaborating the results 
further, I became the principal contestant of the alleged invul- 
nerability of the system. For this and for other reasons, I was 
directed by Colonel Fabyan to put the results of our studies on 
paper and thereupon 'wrote a brief brochure entitled "Methods for 
the Solution of the A. T. & T. Cipher Machine." The paper was' 
prepared in March 1919 but no copy was sent to Washington at that 



^Courtesy title (an honorary colonel on the staff of the Governor 
of Illinois) .. He died In 1955* 

2 The Department of Justice had one roving agent, on the Southern 
border, who from time to time solved some simple Mexican ciphers, 
mostly monoalphabetlc in nature. 



- 2 - 





REF ID:A4148948 




tine. Instead, Colonel Pabyan began writing letters to certain 
people and made what appeared to the® to be some rather broad 
claims. 

In August 1919, after a considerable amount of correspondence 
which was becoming rather acrimonious (largely because Colonel 
Faby&n, purposely or inadvertently , wrapped a veil of obscurity 
around what he thought we were able to do) , the then Director of 
Military Intelligence, Brigadier General Marlborough Churchill, 
sent Major Yardley to Elver bank to look into the claims which 
Fabyan was making as to the vulnerability of the system. The prin- 
ciples w© had elaborated to solve this cipher were explained to 
Yardley, who returned a few days later, accompanied by Lieut. Colonel 
Mauborgne, the Signal Corps cryptographic expert who had been 
directly in charge of the development and who, 20 years later, was 
to become Chief Signal Officer. Th© proposed solution was explained 
to both officers, but Colonel Mauborgne contended that Riverbank 
really did not know the Signal Corps 8 method of use. Although it 
was true that permanently fixed lengths of key tapes (1000 and 999) 
had been contemplated in the original method as proposed by the 
A. T. & T. Co., Colonel Mauborgne stated that the Signal Corps had 
different ideas 2 the two key tapes, he said, could b© variable in 
their lengths, prime number a being preferable; and there were other 
new procedures in their usage which would invalidate the solution 
proposed by the Riverbank investigators. Th© record contains the 
followings "Colonel Mauborgne left with us a rough pencil sketch 
of the manner in which the machine Is now used, reiterating his 

opinion that as now used, the cipher is invulnerable. Colonel 

Mauborgne said further that If we could break the cipher when used / 
in accordance with these rules he would then acknowledge that we 
had broken the cipher as used by the Signal Corps . " 



A day or two after the departure of these officers, two copies 
of my paper of March 1919 were sent to Washington, on© for the 
Signal Corps, the other for G-2. The conference also resulted in 
an agreement that Riverbank would accept the gauntlet thrown down 
; by the Government and would try to prove its contention of vul- 
nerability of the cryptographic system by solving © set of "challenge 






The Riverbank cipher staff studied the new situation presented 
by the change in procedures adopted by the Signal Corps and found 
it unnecessary to change its original position regarding the 
vulnerability of the system. Again I was asked to put the results 
of our studies down on paper, and wrote an addendum to the original 
paper (Addendum No. 1), which is dated 19 August 1919* The 
Riverbank. staff then awaited with, confidence (not unmixed, however, 
with some trepidation) the receipt of a promised set of 150 cipher 
tapes representing the "challenge messages." These were to consist 
of messages sent in one day's traffic among four simulated stations 
forming a simulated net. 

Unfortunately, when the cipher tapes arrived, on 27 September 
1919, there were found among the "challenge” cipher tapes four 
plain-text tapes, the latter having been inadvertently included. 
Rather than accept this "bust 0 and becloud the Issue further, we 
immediately notified the authorities in Washington of the error and. 
on 8 October 1919 received a new batch of cipher tapes; 1 This time 

*1 must admit, however, that we nevertheless derived !~consi^^able°” 
benefit from the "bust," for it told us much about the construc- 
tion of the messages- -the nature of the addresses, signatures, 
etc. It will be seen later how useful this knowledge became in 
solution. I do not think we could have met the challenge success- 
fully had it not been for this error. 8 
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no plain-test tapes were among the challenge messages and the River- 
bank staff began its work. The labor was somewhat arduous and after 
some six weeks 8 steady work, often 12 hours a day, my collaborators 
had all deserted me, when all our efforts seemed fruitless and the 
problem a hopeless one. However, with what, appears to me today as 
rather dogged determination (how I yearn for those days of youth! ) , 

I stuck to the task all alone. Finally, on 8 December, exactly two 
months after receipt of the "good" challenge messages, I, too, came 

to what seemed the end of the trail — mentally "down but not out." 

\ 

Reviewing the situation quietly, with my feet on top of my desk 
and pulling at my pipe {yes, I smoked one in those days!), I came to 
two conclusions: first, the principles of solution were correct and 
had to yield the results we were seekingj second, somebody had made 
an error somewhere in the work and the error had to be found before 
further progress could be made. What we had received from Washington 
were perforated tapes and these had to be transcribed into characters 
on sheets of paper. Could it be that one of my assistants or I had 
made an error in this first step? There were three crucial messages 
involved — they had been the raw material for endless exper iment — -and 
I decided to check the transcription from the tapes myself. Wo 
sooner thought of than I proceeded to the task. < 

My ruminations were quickly rewarded when I discovered that 
one character had indeed been omitted accidentally in transcribing 
one of the three tapes — but that character was at a very crucial 
point. Making the necessary correction, T called my staff together, 
explained the situation, and asked for volunteers to tackle the ' 
problem once more. There was 1Q0# response (all six of them!), 
although I could easily detect that my staff remained cynical but 
had decided to humor me in my fatal delusion. However, it was no 
delusion, and I, myself, was the lucky one to dispel it. For within 
ten minutes and with mounting . Internal excitement (some of my readers 
will recognize the symptoms) I had obtained, as a resultant of the 
trial of -two hypothetical addresses, the letters EQU. Wot much, to 
be sure--we had often before obtained excellent trigraphs, tetra- 
graphs, and even pentagraphs that turned out to be discouraging 
accidents. But I continued, thinking to myself: "If the next 
letter turns out to be a vowel, preferably an I or an A, maybe I 
really have something here!" The letter that turned up was the 
letter I--EQUIJ Hardly able to repress my excitement, I went on: 

"In the name of all the patron saints of the Kingdom of Cipher, let 
the next letter be 'the letter P," I prayed. And a P it was! "I've 
got It!" I shouted, "I really have, this time." It was a bit dif- 
ficult to convince my collaborators and echoes of disbelief rever- 
berated. But soon, gathered about in a tight huddle, a convincing 
demonstration, consisting of adding d few "good" letters immediately 
before and after EQUIP, left nothing more to be desired~~exce.pt the 
reconstruction of the key tapes. The challenge had been success- 
fully met, but it had taken much longer than had been anticipated. 

The two unknown key tapes were reconstructed coincidentally 
with the solution of a few of the challenge messages and then, to 
prove beyond shadow of doubt that the system had been solved, we 
enciphered three messages of our own, addressed to certain officials 
In Washington, using the reconstructed keys. Our messages were 
enciphered "by hand," for we did, not have any of the machines. The 
Telephone Company in Chicago kindly gave me access to a keyboard 
perforator, by means of which, very laboriously (by the "hunt and 
pecl^ method) , I punched out the cipher tapes. The latter w v ere then 

sent by mail to Colonel Mauborgne in Washington, where, promptly on 

— — — ” ' “ ‘ " 1 " “ ■ 1 —— — ■ ■ 

Because of the transcribing error mentioned above. But not all the 
time loht on' that account was sheer waste, for It was during the 
period of fruitless struggle that all the short cuts were developed 
which' greatly hastened solution once the error had been found. 



- 4 - 




REF ID:A4148948 



[TOP D C C R FT//C 0 M I NH 



receipt, they were deciphered by machine with his own key tapes. 
Colonel Mauborgne immediately thereupon and without reservations 
acknowledged, as premised, that the validity of the Riverbank con- 
tention had thus been fully proved.-*- Soon Colonel Mauborgne and 1 
Major Yardley visited us once more, to learn the details. The suc- 
cessful outcome of this experiment naturally called for another 
addendum to the original paper, and this became Addendum lo. 2. 

By this time the cryptanalytic staff of the Military Intelli- 
gence Division, finding itself in a rather embarrassing position 
and insisting that the initial point of departure in the Riverbank 
solution was a knowledge of the starting points of the two key tapes 
for each message (how true.'), proposed that these initial points be 
disguised by means of a specially prepared small code and then 
enciphering the code groups by three independent mixed alphabets. 

The proposed method (but not the code or the special alphabets) was 
submitted to the Riverbank staff for comment, and I wrote a third , 
addendum to ®y original paper (Addendum So. J>) , proving the inade- 
quacy of the proposed method of disguising the indicators. Two 
copies of Addenda Hos. 1, 2, .and 3 were now sent to Washington. By 
this time the war was receding into the dim past, the Army author- 
ities were tired or somewhat groggy over the whole business, and 
thought it best to call a halt to it. As a consequence, further 
work on the A. T. & T. Co. Cipher Machine was stopped and the 
machines put in storage. Soon thereafter I left Riverbank to accept 
the position which was established for me in the Office of the Chief 
Signal Officer in Washington, as the chief (and only) cryptanalyst. 

I did a little research, when time permitted, on improvements in the 
printing telegraph cipher and proposed one which was soon made 
public by the issue of a patent. (Sow naive w© were in those days! 
God forbid that the improve ment disclosed in this patent be adopted 
and incorporated In I ~~| l) 
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In view of the present situation in regard to the 



A. 



, it occurred to me that the Riverbank technical papers on the 
T. & T . Cipher Machine, even though they were written many years 
might still be of some value or would, at least, be of histor- 
ical interest. A search through the old files at Arlington Hall 
yielded a copy of the basic paper, Addendum 1, and Addendum 3, but 
alasJ a very thorough search of all files in Washington failed to 
turn up a copy of Addendum 2. A letter to the Riverbank Laboratories 
brought nothing. Colonel Pabyan had long ago departed to the next 
world, as had his secretary. The Deaprtment of Ciphers had ceased 
functioning soon after my departure and all its files bad been 
destroyed. So there was no Addendum 2 to be had, which was unfortun- 
ate, because It was perhaps the most interesting one of the® all: 
it was the one which dealt in detail with the solution of the chal- 
lenge messages*. The only material I could find among my old and 
\ ? ery dusty personal papers was a badly marked up first draft of 
Addendum Ho. 2, with many diagrams missing but with considerable 
number of miscellaneous sheets of notes, queer **doodlings , " etc. I 



^Following is quoted from a letter dated 29 Dec. 1919 from Colonel 
Mauborgne to .Colonel Fa byan: "You have done a great work and your 
contention of last March is sustained - that the method of using 
the printing telegraph cipher as used last year by the Signal ' 
Corps was decipherable,. This is, perhaps, the toughest indivi- 
dual cipher you have ever had to tackle. To the victor belong 
the spoils. 5 " 

PDF ' 3DC.RET//COfytt W3 — 
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do not know whethez* It was Worth the effort, but I have done my 
best to reconstruct Addendum 2, within the limited time at my dis- 
posal. It is not adequate, and I am' sure that the final Addendum 
2, when- it left River bank, was a very much better paper. H owever . 
it is my hope that some of our workers and collaborators on 



may f ind ,in these papers some tiny fragments of interest. For me, 
tiiey are an echo of interesting events of a distant age; but the 
thrill of a successful meeting -of a serious challenge is still 
vivid in memory.! 

I have made no changes whatever in the texts' of the basic 
paper, or in Addendum No. 1 and Addendum No. J. Because of the 
unfortunate failure to find Addendum No. 2, I have had to use, as 
noted above, the first draft. This, too, I have faithfully repro- 
duced without changes of a material nature. The papers should 
therefore be read, not in the light of the present state of crypt - 
analytic science, but In the light of the art as it was in 1919— 
a long time ago, when considered in terms of the progress that has 
been made since then. 

In the light of these resuscitated papers of long ago, one 
fact takes on a special significance: the present usage of a system 
over 30 years old points to a lack of sophistication or imagination 
in cryptographic invention. This lack receives confirmation when 
we take into consideration other things that we know, and I feel 
tha t we sho uld not be too pessimistic about the future. Currently, 

the | I problem is, in certain respects, much more diffi cult 

than the one which confronted the Rlverbank staff in 1919. | 



J than were- those Involved In 

the Rlverbank solution; but more important by far is this difference 
there are I 



J because in -the 



latter ne ither key tape was ever used by itself, only In combina- 
tion, apd | 



it is frequently the case that the| 



_ ; this Is something which would have greatly 

assisted In the Rlverbank solution — In fact. It would have elimi- , 
nated most of the problem. ' " 



Finally, there Is one more aspect well worth noting and of< 
current interest. 

The Rlverbank staff solved what was for those days, I think, 
a very complex problem, and it accomplished the task under cir- 
cumstances which, considered In the light of what can be done 
cryptanalytically today, were rather difficult. 

1 In the first placed the staff was very small in numbers and, 
with one exception. Its Members had relatively little training in 
theory and very ’little practical experience in "operations" as 



^As of possible interest to my readers who may care to look into 
It, there is on file a paper entitled: "Extracts from corres- 
pondence relating to solution of A. T. & T. Printing Telegraph 
Cipher," together with certain letters which explain why the 
Extracts were prepared. They give further details of the story 
and its background. - 
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conducted in these days. In the second place, its procedures and 
tools were relatively weak and undeveloped* for modern methods and 
techniques were just in their infancy. In the third place* it had 
only one set of messages on which its contention of vulnerability 
had to stand or fall. And if it had failed on that single set* it 
would have completely fallen down on the job it had undertaken— 
for no other set of messages, X feel sure* would have been ®&de 
available to permit another trial to be made. In the fourth place, 
and possibly of greatest import, the River bank staff solved the / 
problem without the aid of machinery of any kind whatever. 



Of course, we were always on the lookout for ” short cuts” and 
”hand rt aids to speed up the cryptsnalytic testing. I do not think 
we suffered from lack of imagination, but the machine age in crypt- 
analysis had not yet dawned. Tabulating machinery was just in its 
infancy; its use as an aid in cryptanalysis was not even conceived. 

But the Riverbank staff* small as it was* without adequate 
training and experience, lacking special machinery* using what may 
today seem rudimentary methods, and having only a single, relatively 
small sample to begin with* nevertheless successfully met the 
challenge offered by the Signal Corps and G-2. Today* with the aid 
of high-speed electrical and electronic devices* with much advanced 
eryptanalytic theory, methods* and techniques* with an adequate 
staff of enthusiastic, competent researchers* and a plurality of 
sources from whi ch examp les to be worked upon can be selected, it 
seems to me that I I should not be a hopeless problem. While 



the odds against our present workers may be greater than they were 
against the Riverbank workers* the tools and methods of the former 
are very much better than those of the latter; and over and beyond 
these considerations there is this one; the urgency* importance, 
and possible fruits of a successful meeting of the 1948 challenge 
are so much greater than those of the 1919 challenge that no com- 
parison whatever can be made In these respects. Just as the 
Riverbank workers met the challenge presented to them in 1919* with 



far less at stake, so 



workers will success- 



I feel sure our 

fully meet the far more difficult but mucn more important challenge 
offered them in 1948. 
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'contests. 

1. OPERATION OF CIPH® MACHINE o 

I 

Advantages., speed and ease of operation^ accuracy and 
possibilities in the way of difficulty of decipherment * 

Weaknesses* danger of overlapping portions of messages; 

I 

necessity for certain characters vMch operate the machine and are nec- 
essarily a part of the cipher message; reciprocity in cipher square 
makes easy re const ruction o 

2o Solv&ion of single key messages which overlap; detecting 
overlapping places,. 

3» Solution of double running key messages which overlap; re- 
construction of keys from solved or captured messages Q 

4. Decipherment by super imposition of cycles with nothing given 
©swept that which is inherent in the machine it self * Decipherment of sub- 
sequent massages vdth recovered keys* 

5« Length of cycles determined by solution* depending upon key 
indicators • 

6 0 Cipher square or chart * 

(a) How it is constructed* primary form. 

(b) Changed from primary into secondary square for con- 
venience* 

(c) Reciprocal relations however used* Makes reconstruction 

* 

of square easy* 






( 
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PRINCIPLES USED IN THE SOLUTION OF THB A, T„ & T. 

HACHIKS CIPHER. 

In cT^asp 193.8 c, thera was submitted for <sur ©sosainsticn by th® 

Ao To & To Company* and th© of fie© of the Chief Offiesr of the 

1 

United States Ag’jjgpp dstaila and ©samples oS the work of a cipher machine 
to be used in transmitting gscrst official e cmmuaieat ieaa 0 After eonsid- 
©rabl© study have formed the option that th® ayote® posssees© certain 
vealaessas which permit of aa attack ®pon th© cipher and render it unsafe 
for matters of importance o 

We shall try to show first that tha slightest carelessness on th© 
pert of any Individual entrusted with the actual work of enciphering vail 
lay all the messages enciphered by means of th® same keys open to easy sol- 
ution. Sine© carelessness <m th© part of th© personrcal t© to entrusted with 
tfo operation of th® machins Kid iterance on their part of the reasons for 
©very precaution necessary in cipher work ar© to be ©sgjeetod, th® existence 
of this opening for m attack must b@ admitted. Secondly*, we shall attempt 
to show a granting not only an absolutely infallible operation of th® machine 
by the personnel * but also th® theoretical absolute ^decipherability of a 
message enciphered by means of a rardonwdxed* single*, non-repeating* running 
key* that the mechanics of the machine* and certain features of the system* 
are such that an attack 3s not only practicable* text easy under normal con- 
ditionso 

It will be unnecessary to go into details of the operation of the 
machine* inasmuch as this report is addressed only to those who submitted it 
for examination o 

We shall discuss the solution of two cases: 

(1) uters message's have b sen enciphered incorrectly 

two or more being in the same k©ys 0 , 

(2) Where massages have been enciphered correctly* 
mens to&xg in th© same k©ys. 
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lo SOHITION OF A CASE WHERE TOO MIS SACKS HAVE BEEH 
ENCIPHERED BY TOE SAB® KE©» 

M us suppos® that in' the two message given feslew the first 
has been enciphered by the keys indicated and that, through an oversight 
or carelssgnsss, the second message mas thei snciphered by the same ksys 9 
beginning at sssaetly the sans point in eaeh key. The result of such an 
error is that both messages have been enciphered by the asm single key, 
and ws may- disregard for the present the feet that a double kay was used. 
W® give the details of the solution of such a ease, not because there is 
anything original or seemingly impossible contained there in, but because 
certain phases of the principles elucidated will be used later in the dis- 
suasion of a mo re complicated cas© 0 

MESSAGES. 

i 

LEITPP QP JH Q 4 R M V HIHfiO I6HDP 

IH3RF Y?GCG 3HRXQ'TGG?E IFORT 

\ 

f IGIH J B P S 5 DP J 5 B K W M A X C G X 3 D 

ELHXU PHHX LKKWtJ 0 I S C R X I E etc. 

©tco®tco CEL2WC3SKC 

2.EITPP Q P J M Y QPRRB S J E 7 H P JI 4 P 3 

MNOAU F V G C II JXECI X3I7P K 3 G J I 

TDH',7 S E 7 E 2 KZ2P6 SHI25 FLWY3 
U, Q H A M 7LDHT GB 5 1C DVMJT XL Q etc, 
etco etc. 4HZUF C R 3 E X J P 6 3 Q U Q 

We my disregard the first seven letters in both messages, 
since they deal with the key indicators. The nest four letters, J,M,Y,Q, 
being coumon to both messages, probably represent kl*25» (functions of 
machines carriage ret urn 3 line feed, letters). Vfe may begin working, 
therefore, from that point on, as shown below, putting the messages di- 
rectly bens at h each other* 



- 2 - 
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Messol - 4RHVMXMH0X6HDPYH3RFV7GC03NRX0YGG 

Mess o 2 » ? R R B S J E 7 Ii F M 4 F 3 H H 0 A U F V fi C II J X S C IX 3 I 

Messol - TRIPORTTIO! BJ B P S 5 D P J 5 B K ff H A X C G X 3 U 

Mess o 2 ~ v p K 3 Q J I T D W I VJ S E 7 E 2 K Z 2 P 6 S H I 2 5. F L W I 3 

Messol - K LHTUPYJMXLXKWUOYSCRXIE etc* etc* CS12 

Hess o 2 - 0 Q H A M T / L D !! T G E 5 G C D V IS J T X 1 Q etc* etc* 4 H Z HJ 

i 

Heas.l • TC 3 S K G 

Mess .->2 » F C R 3 t X J P 6 3 Q U Q 

How in all massages ne nay aspect to find both a series of 3 S 3 
(spaces) and 44 2 (carriage return and line feed) , rs pasted irregularly at 
intervals throughout the messages,. If vie can locate in one of the messages 
a series of 3°3 or the combination 442, or any otfrsa? plain text, then ws may 
find what the plain text of the corresponding portion of the other message is* 
The complete symmetry of the cipher square, giving rise to reciprocal rela- 
tions between the three elements, key, plain text and cipher, in a manner to 
be explained bales, makes it possible to recover the single key, given the 
cipher and the plain texts This is the first weakness in the cipher systems 
In this example, we may start off ty assuming that the plain text 
of one of the massages consists of nothing but a series of 3 8 s, and then 
find out what the plain text of the other massage would be on this assump- 
tion, fcgr referring to the cipher square j that is, by finding the single key 
letters concerned for the tentatively deciphered portions and applying them 

to the corresponding portions in the other message 0 For example, the first 

\ 

cipher letters in the two messages as arranged for decipherment are 4 and P 0 

i 

If we assume that the plain text equivalent of 4 is 3, then the key letter 
would be 1$, in which case the plain text equivalsit of P would bs G 0 lf p 
on the other hand, we assume that the plain text equivalent of P is 3, then 
the key letter would be L, in which case the plain text equivalent of 4 would 
be G cilsoc. But the result of assuming the key letter to be 3, applying it tc 
4, which gives N, and then applying H to P, is also G| and the result of as- 
suming the key letter to bs % applying it to P, which givss L, and then ap= 
plying 1 to 4, is also G« These relations, as stated above, hold true be- 
cause of the complete reciprocity of the cipher square 0 It is els®* there- 
for^, that we can omit, for the present, the intermediate step of determining 

= 3 “ 
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th8 ksy letters* and find simply the plain text of th© other message 
directly from the squars* by considering only the three element 3 s assumed 
plain text, cipher of massage 1* and cipher of me s sags 2 e This can b© don© 

in on© operation by proceeding down the columns headed* for example by 4 and 

i 

P* in the cipher square* until vie com to 3 in one of th© columns* wtez*©^ 
upon it will be found that G is in th© other column on the same line as 3 0 
or we can proceed down the oolunsis headed by 4 and 3 to P in one of the col» 
umns* whereupon G will be found to be opposite P in the other column cn the 
same line., Any three letters my be chosen to find the fourth in like man- 

s 

nay* since the four elements* 4s P* 3 and G* exhibit couplets reciprocity 0 It 
will be noted that the letters 4* 3 and G appear at the four corners of a 



rectangle in the cipher square* and that there are six times 32* or 192 such 



rectangles in this square* at the corners of xvhich th© letter’s 4* P* 3 and G 
will appear® See Pig® 1 9 

! 

PIGo lo CIPHER SQUARE 

ABCDEFGHIJKL i MNOPQRSTU?WXTZ234567 
A7GFR2C3QS4$25&6XHX>XW3XT?PLEUJM0A 
BG7QT0HAF5tPJiSXEKCWMD7UR3®46XZI2B 
CFQ7nXAHG48EHL2POB3JTDTXW65HRZZTC 
DRT0 743WXK2I6ISZ5VAHBCQGHII0 JFEPLB 
B20K47B6XURCVXFBQPJ3ZI5X>URTASD7aE 
F C H A 3 K 7 Q B J I 2 5 Z E Y 6 G U 4 X R 3 V T 0 H K D S L P F 
GBAHTT6Q7CKZT4IP2BFT5BX3DUKJ0VLSEG 
HQFGXIBC7L5 6I40H2A7Z3HRBDESP THJKH 
I S 5 4 S U J U 7 F B H G R 7 T Z R A P E 0 I 6 If Q 3 2 C B XI 
J4LS2RIZ5F73BQUTrXl(EC6HT0P7GDKAHTJ 
KNPEIC2T6D37XT7AQBOSR54ZlfLG7FJUTHX 
LZJM6W5'4XHBX7C7R3SOQ2TNEKUATPGF1)L 
M 5 S L ! X Z I 4 G Q W C 7 ?3 R J P B N 6 2 K E D P 7 0 H A U M 
RET2SFEPORUA7T7RG6IDHJL5ZBXC43WQR 
06EPZBT2HVI7QR3H7CKLX45IJSFDGHTUA0 
PTK05Q6N2TXB3RGC7EHI7IZ4SJAUHL7DFP 
Q H C B 7 P G F A Z M 0 S J 6 K E 7 X L D T D 3 R 2 1 I If 5 4 K Q 

R D "f 3 A J U T 7 H E S 0 P I III X 7 K 5 F H B q 5 U C 2 Y Z R 

S I If J H 3 4 5 Z A C R Q B 0 X UL K 7 I 2 6 P 0‘T H U E F G 7 S 
TT7DVBZXR3P652RM4I8QX7QCAFSELHOKJT 
D 3 7 D C I R X E N 4 X 6 J 5 z T F 2 Q 7 B H G L P S A K 0 M B 

VXUTQ5W3ROTZH2LI4DH6CB7FAJKMGPESV 

If T R X G L 7 D 0 I 0 H E X 5 J S 3 B P A H F 7 C I 2 Z Q 6 H 4 W 
XV3I7HMTUD6PLKEZSJRQOFGAC74N5BY2IX 
XPN6MH0KE1I7GUDBF A2JTSU I 4 7 3 QZXRCI 
Z l 4 5 0 T M J S Q G 7 A F X 0 C I 6 H E P X 2 H 3 7 W I B C R Z 
2B6KJAK0P3DFITCGHI4DLSMZ5QU7IRXB2 

3 D X R F S 0 7 T 2 K J P 0 4 M L I C E !I A G Q B Z I 1 7 H 6 5 3 

4 J Z I E 0 S i M C A D G H 3 T 7 5 2 F 0 K P 6 X X B R R 7 Q If 4 

5 1IZP7LSJBHTF A. .77 RD 4 10 K OK » 2 R C X 6 Q 7 3 5 

6 0 2 X L G P E K X T H D U Q A F H Z 7 J i! S 4 1 c R B 5 If 3 7 6 

7ARCDEFGHIJKLUNOPQRSTUVWXYZ234567 
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Applying this process of assuming one of the messages to consist 
exclusively of 3®s 8 the plain text of the other message is shorn in Fig 0 2 S 
on the line labeled "Equivalents of 3o n 

! FIG* 2* 

Message 1- 4SUVMXHHOX61IDPYH3RFV7GCG3HRX 

Message 2- PRRBS JE 7HFM4F3MH0APFV0CMJXBC 

Equivalents of > G 7 L A X L B £) 4 H A 7 7 P F 3 0 F CQG 3 3 2 JIEQ 

Message 1- QIGG IB IP 0 RIT I G I H J B PS 5DF J 5 B K T 

Message 2- IX 3 I 7 P R 3 G J I T D 1? I 1? S E ?E 2 K 2 2 P 6S H 

Equivalents of 3” Y H GOHW F F ISL 3QF3ARM L 7 B 2 0 F F I C A 

Message 1~ MAXCGX30ELHYUPYJHXLKKWU0YSCR 

Message 2- * 125FLWY3UQHAMWLDMTGE5GCDVMJT 

Equivalents of 3“ V S I 3 N R Y$ 2 E JT 5 E A I H D N R H F F Y K X BT 

Message !■=> X I E etc* etc* 

Message 2» XL Q etc* etc* 

Equivalents of 3- 3 T L 



Kote the underlined portions of what is apparently excellent plain 
text* The first one spells out 3® , p which suggests 30F3® Twenty-two letters 
beyond that v® find 3*9^3 ABM a which suggests 30F3ARMXS* Five letters beyond 
that we find <FFIG S which suggests 3CFFICE3* or 3QFFICER(S)3 8 or 30FFXCIAL3* 

;> I 

These plain text portions may or may not belong to the same message e since 

we cannot toll yet to vfoich message ary tentatively deciphered portion belongs* 

Iot as now try a series of 442's in plat® of a series of 3®s* In 

other words s we may assume that one message consists exclusively of a series 

of 442 'Sg and see what the plain text would be for the other message* We may 

start by assuming 442 to occur at the beginning of one message^, and see what 

it gives for the corresponding pLaca in message 2 f thus s . Q 

Message 1 - 4 R M 
Message 2 ° P R R 
Assumed plain text » 4 4 2 
Equivalents of 442 - P 4 H 

Since P4H does not constitute any part of a plain text word p we 

try the sequence 442 one space to the right* Thus? 

Message 1 - 4 R M 7 ^ 

Message 2 ° P R R B 
• Assumed plain text - 4 4 2 

Equivalents of 442 - 4 V S 



i 
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Shis combination,, i$S 9 is likewise no part of a plain text 
so we try the s ©queues 442* one* two* three . o . « . spaces to 
the rights, taking not© of all th© gpod combinations *#iieh rasult in 
th® othsr nisssagso ta* a short cut to this process is to fill out 
on on© line tha equivalents of 4? on a line below* the equivalents of 2j 
then the first two members of any sat of tha three equivalents of 442 will 

be found by taking tYa sequent letters on the first of tha two lines of 

\ 

I 

equivalents a and the third member of the set of thrse equivalents will be 
found directly to the right of these two letters on tha lower line* 

Thus? 

( P 4 H 

Equivalents of 442 ( 4 V S 
in succession: ( 7 K 6 

(KZH 
( etc. 

Applying this process throughout both messages* we have what is 
shown in Fig. 3* which includes th© equivalents of 3 9 sine© we may as wall 

combine th® results of both experiments into one figure to see if we can 

» 

piece together such portions of the tentative dsclpfcsrment as my be given. 

FIG. 3. 

'Nassau l~4RM¥MXMMOX6NDPYR3RF?7GCG3NRX 
Massage 2~PRRBSJE7HFM4P3MHOAUFVGCMJIEC 
Equivalents of 3 “ G 7L A U B 0 4 H A 7 7 P F 3 0 F CQG332JIKQ 
Equivalents of 4 ” P 4 7 KZ 7 Y H 3 0 K N HG E 4 H E 2 6 P 4 4 C B B A 6 
Equivalents of 2- HS6H57CLSIITJ27J4ZM223FBI)Z 

Message 1 » Q Y G G T E I F 0 B T T TG I K J B PS 5 D F J 5 B K W 

Message 2 ° IX 3 X 7 P K 3 G J I T D W I ITS E 7 S 2 K Z 2 P 6 S H 

Equivalents of 3“ YNGOHBFF ISL 3 0 F 3 A R M L 7 B 2 0 F F I C A 

Equivalents of 4 ° B 7 P H 0 5 E E R D 74 HE 4 K I T 7M Y C H E E R 2 Z 

Equivalents of 2»BRM7LYJJ7AH27J2SNGHI517JJ74S 

Message 1-MAXCGX3UEL HYUPYJN XLKKWU OYS CR 
Massage 2 - 1 2 5 F L H 3 U Q H A M :i L S l! T G E 5 G C D 7 I J T 

Equivalents of 3 - 7 S I 3 f! R Y 3 2 E 3 l 5 E A I H D H R H F F Y K X E 7 

Equivalents of 4 " LB'R ^ 7 I B J C F 4 7 tV P K R 0 S 7 I 0 E E B A Z F L 

Equivalents of 2 » 0 A 7 2 R E B 2 3 U 2 H B U S 7 L K R N LJ J !7 I) 6 B 0 

Message 1-XIE..... ©tc. 

Messa ge 2 ** X L Q a . . . . etc . 

Equivalents of 3 =» 3 T L 
Equivalents of 4 ■- 4 M V 
Equivalents of 2 » 2 P H 



1-4RMTHX 

Equivalents^of 4~ P 4 V K Z ? 
Equival mt s of 2« H S 6 H 



1 



} 

1 
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laiESdiatoly preceding SQF3ARM (the rssult of a series of seven 
3 ,J s) we have L and before that BRA (the result of 442) o I'foiing that the L 
can be joined to the ERA and then to the 30F3ARM, we have the following: 

i 

Plain test of one message -ORPS44233333333AJJ 
Plai.n text of other message -3GEWERAL30P3ARMY4 

Immediately following the place where ARM occurs we have the 

i 

following: 

Plain tact of one message -NY30FFIC 
Plain teat of other message - 442 33333 

7/e can join these two portions , and assisting that ffiFS is a part 

of the name 3SIGNAI.3CORPS s we have: 

t 1 

Plain text of one message “3SIGNAL3GORFS442333 
Plain text of other message -3ADJUTANT 3 Q ENERAL30 

Plain text of one massage -33333ANI30FPIG 
Plain text of other massage ~F3 ARMY 4 4233333 

J 

With this amount of intelligihlQ text to build upon,, it is not a 

r 

difficult matter for the cryptographer to c oaklets the decipherment of these 
two messages* applying the principles elucidated above s with this modifica- 
tion: that continuation of text in one message results in continuation of 

text in the other 3 without a recourse to the assumption of a series of 3 ff s 



To recover the key we have but to take the plain text of either* 

i 

massage* and one of the cipher messages and refer to the cipher square 0 Ware 

the two messages exactly the sane in length* it mould be impossible to tell 

l 

whether' the cipher message labeled 1 above applies to the plain text message 

beginning TO ALL OFFICERS, or to the other me3sa@3 0 In this case, however, 

the messages are not the same lengths The ending3 are as follows: 

1 C B li 2 !f C 3 S K C 

2o o o « o „ 4 H Zj 0 F C R 3 L X J P 6 3 Q U Q 

The dacipherment up to tho portion where the two me 3 sagas no 

longer overlap is as follows : 




REF ID : A4148948 



1 C EL 2 W C 3 s K C 

jS iiL jOj| & | q | . o t u Q - 4 R 3 

'OFFICER 6” 

70C1TE 3GEK 

It is evident that the second message ends .oca V0CATE3 
GENERAL3-, and we can now attach aadi cipher to tha proper plain text. 
Cipher message 1 begins TO All. OFFICES j cipher message 2» COL J B 
EMERSON* 



The couple ted work appears as shown in Fig. 4o The solution 
of such a case present no great difficulties to the de cipherer 9 although 
the process may be rather slow. 



I 



FIG . Ao 



CvK*d*»f<s* no fO Kt» <=» «■ 



XCKQ3YZX24MT 
Plain text of one message^ 4 4 2 5T03ALL30FFICERS 
Plain text of other massage” 4425COL3J 3B3EMERSON 
Cipher - -- -EITPPQP J] U I Q 4 ,R M V M X I M 0 X 6 N D P I 
Cioher BIIPPQPJBIQPBRBSJB7HFM4F3M 



Single key - & MO D C H 6 R 5 2 P 17 S EH 2G Q AS I U H H 2 
Plain text - 30F3THE3SIGHAL3CORPS4423 3 333 
Plain text » 333CARE3ADJ0TANT 3GKNERAL30F 3 
Cipher - » « K 3 R P 7 ?G C G 3H R XQ TG G T E I F OR T T IG I 
Cipher — » H 0 A O F 7 G C M J X E C I X 3 I 7 P S 3 G J I T D I 

i 

Single key - TSXIDRFYIL5BLFIB4PBHW7P2WXGP 
Plain text - 3 3 3 A I I 3 0 F F I C E RS 3 I H 3 T H E 3 S I G K A 
Plain text - ARMY4 4 233333IT3IS3REQUESTED3 
Ciphsp - - - H J B F S 5 D F J 5 B K WM A X C G X 3 0 E L H 10 P? 
Cipher “ — S E ? E 2 K Z 2 P 6 S H I 2 5 F L 17 I 3 U Q H A M W L 

Single key - B4WRSBPAZH7476R6. . ate. . . . . P II 5 
Plain text » l 3 C 0 R P S 3D E S I R I H G . . etc. . . . . OFF 
Plain text *=■ THAT3INF0RMATI0N 0 0 etc. '« . . . 7 0 C 
Cipher - -- J HI K K ff U 0 IS CR X IE . . etc. .... CEL 
Cipher - -- DMT6E 5GCD7MJT XL Q 0 . etc. .... 4 H Z 



Single key - 3XKC7.WZRM0PM64 

Plain text - ICER6JJ5 

Plain tact - ATE3GENERAL6M5 

Cipher 2IC3SKC 

Cipher - - - 0 F C R 3 L X il P 6 3 Q 0 Q 
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i 

2. SOLUTIC'N OF A CASE GIVEN FIVE MESSAGES CORRECTLY 
ENCIPHERED;, NONE BEING IN THE SAI5E KEIS . 

It is clear that if ©na kay is 1*000 letters in length md the 

< 

other 99% tte resultant single key could not begin to repeat itself until 

o 

999»C€D letters have bean encipher ari, This fact obviously precludes the 
possibility of an attack upon the ssn© principles as ©plained in the pna- 

03 ding section* since overlapping msssagas would very rarely* if ever s occur 

i 

except as the result of errors, VShile it is true that the resultant single 
key is a nonrepeating* random=mixed key* yet the fact that this single key- 
results from two keys which remain constant, thou# shifting with regularity* 
permits an attack to be made upon the system. 

It is clear that if a Brassage begis^with the keys OGL^OOl* after 
1*000 letters have been enciphered* the long®* i®y will have mad® one com- 
plat© revolution* and the shorter key will have made on® couple te revolution 
plus on© letter* resulting in bringing back the longer kqy to OGSL and th© 
shorter key to 002 . Thes© two revolutions constitute what m shall term a 
gyeloa and in this instance* tha first cycle will have been coiapletsd, After 
2*000 letters* the longer key will have sad© exactly two complete revolutions* 
tls shorter on® will have mad© | two letters more than two complete revolutions* 
resulting in bringing th® longer key back to 001* end th© shorter key to 003 « 
This would be the end of the second cycle. These raLations existing between 
the two keys and the cycles are illustrated graphically in Fig, 5* in which 
sequent cycles are superimposed, 

FIG, 5c 

Cycle 1, Longer key - B Q Z 7 3 P K V 6 0 R K etc, . 0 7 X M 
Shorter key - NVACXQ5ETSBQ etc, , , R K N 

I 

Cycle 2, Longer key - BQZV3PN760RK etc, » , V X M 
Shorter key - V A C X Q 5 H T S B Q etc , , R K N V 

Cycle 3, Longer key - BQZV3PN760RK etc, , , V X M 
Shorter key- ACXQ5RTSBQ etc , , RKVNA 

i 

Cycle 4, Longer key - BQZV3PNV60RK etc. . . V X M 
Shorter key- CXQ5RTSBQ etc, • , R K V N A C 

etc, etc, etc. etc, 

j 
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vfe shall talcs as the measure of a complete cycle the longer key, 

Koto that we may regard the longer key as stationary* and merely shift the 
shorter tey one letter to the left after each cycle has been completed. 

The basis of the attack on this case consists' in (l) determining 
and superimposing sequent cyde3$ (2) assuming the presence of such characters 
as 442 and 33333* which cannot be eliminated and still have the machine ftme- 
tion properlyj and (3) recover ing the keys step by step simultaneously with 
decipherment c 

2h order to simplify the explanation of this case we shall show 
first how the double keys are recovered and tested as to correctness* using 
a certain amount of cipher text with its corresponding plain text* disregard-* 
ing for the present the question of how the latter is obtained, 1% shall as- 
sume that the portions of text given below belong to the sane section of three 

i 

sequent cycles* and that wo have the plain text for the first two cycles. 



PIGo 6 e 



Cipher 

Plain 

Cipher 

Plain 

Cipher 

Plain 



8U0QRX5 etc, 
A 4 2 5 A 6 M e tc. 



2 3 4 TV P W 

6 



etc. 



Cycle lo 



S E 4 T K I 4 etc , 
etc. 



,h 



Now the successive steps in the recovery of the cbuble key are 



illustrated graphically in Fig, 7* and the subsequent discussion will refer 

vr': 

to the various sections of thi3 figure, T'fe do not knew what the combination 
of letters in the longer and the shorter key is which produces cipher letter 

I k" 

G from plain text 4 as the first cipher letter in cycle 1* and cipher 2 from 
plain text 6 as the first cipher letter in cycle 2, 3it we may ass ms in 
cycle 1 that the first letter in the longer key is A* in which case the cor~ 
responding letter on the shorter key must be Z* as shown in (1) of Fig, 7* 
in cycle 2* remembering that the longer ley remains stationary* and that 
the shorter one shifts one space to the left after each cycle* if the first 

t 

letter in the longer key is A* then the corresporxiing letter in the shorter 
key* to produce cipher 2 from plain text 6* must bo G* as shown in (2) of 



Fig ,7° 



—10— 



h 



I 
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PLATE 1. 

THE ANALYSIS orTH,: A.T. &T. CIPHER MACHINE. 



P.WERBANK LABORATORIES , GENEVA, ILLINOIS. 



is st-'I : 



W t; i'HHi H: 



-i j ”!' 
1 ! 



CYGLf 



CYCLf 



LONGER KEY IA. 



-I SHQRTERKEY 3 ■ i 1 ■ z& I ; ZQ.-1 j. L I ...1 I. 

1 cipher i " oNuoiR x S »u- , 5N uaR.X 5.4- on.u qr xIs T 

i PLAIN TEXT 4+2 5AfeM4U: r 44 : 1 SiAiM.*#-,. 5 AfcM ; 4 



IPLAin TEXfr 4:4i25AfeMsU : 4.A15A:4«*L 4fl5AbH<i* . I ... ..L r k'~ 4 ± 3i5 AJg *- 44 2.J5IA6 Mi 



LONGER key A 






i i 

- 1-4 



O SHORTER KEY 
*“j CIPHER ! 
[PLAIN TEXT 



i-T : i ■ 



CIPHER HS : 4WPWNtlt 
LAIN TEX T fe M 5 U NL E *W 

■M : pf: 

— "t i r t n 

: - t > ■ i :• 



•[' A'j • 1“ av i 'i 

j. L 1:4 

•i (LS 4 wP W N E S 4VPW N 2 5T! 

6M5UNLE4*- AM5UNLE*:<- 
— i — [— 4 I '4) -r-f 



: A;VCB:.T.rt- Avjg 1 . j A.V20- 

>NufiRx3 *'c. g'n'u-q A x s"* 1 «“ •+- -*•- "~j" gn-C/qp 

'44 25AGPV*. 4 4 2..5A6P\4<.. •'.-44-25 A 

--lJ-HJI ±--2±+p%-jr. 4.1- 

,r A V 2 . : AV 2 r " i r 4 ]"" 

.J. _L J, 6 Up) r 4 T"&u SQ. ! : 

- JEST W P U N «- E 2 5 4. w|p W N : ? :: "t • 

_ 6M5UNLE « <•! 6 M|gL>;N LiE «l 

-ITT kA.jmH j Tcsrrtrhtrr 



... AVJ® 

ZOO ' 



4 6N f a&R'Xt5Atq GNUOiRxis*^ 

•I -4425AGM 4c. 4 4 X 5 ; A <o M etc. 

it-L.4MSL.- JJIJ4SL. XZ. 

- -T I - . : T -*■ - 



! __ ; 

I > 

I t 

■ I 



AVAX(D 
ZG.LLTp. . 
&NIJORX5 *t«-. 
4-4 7.5 A & M etc- 
(15) 



AV'2x 



I AVXX 

Zl" 



! : I ; ! : 

: -jrr; i , 
4-‘-|tJT 1 : i- 

■■ - : T ::f I I r 



Ssr4wP WN *tt X 5 4 WP WN •** 
to M 5 U N L E »t«- LM5UNL £ «t«- 

j s ■ mi j : j : - 

rr : -fri- - 4-i-l 



j- ; .r 

.JJ 






#rtg i ■*! 

i T |4 [ r 

-f m S :•• •• ■ L— . 



: . . I : ' . i i : : i I • ! I i- ■ : !•• • ■!■■. ! ; ■ 

. ME 5 SA£,t Ur m D ic4T(i«!. ■•-- :4 I -i . ! [- • • -I- - ■■■> •- 

■ <yic«.c.4f.r fo lmft.tAToV. L>V9,M''.’ 14 . 

I . - : : 1 1 14-llYDK.ATCK'*. l4'*.-ia<X, 



5 V AGE •j-l»lc*lD#b i>1*<4'5 1 l>»Ft*£r<cS.yf l 



ME55AGE 5-h.oihmas 8^RtXL,T>'rr * . 



iiWllfll 



InEiSAAEL ♦ft.iH£>icAT0K5 flalAYe.54 r. ’ 

I ! : I ! ■ i I : i : 



i ; a r 

t ; a • 

T1 1 at 

r I t 35i 



ME'XiKGE Ti -MiitXTiHi 20) lBS,l>nr.’ 45 



.Mf)4AL,e 19-!'>»K-An)4S.3N-t-49.tirF : 'c li - ■ ■ 

i Ill— I— J.t> - l«b"t/»»OR.5i Oil L 994, JiFTi lfc 

i ii. i i- 1 -i i ..I Mn^»4Cit 21- iripononi. Mo-fjsy. yi» <r \S ! , .. 



|M.fpSA|Gfclj6-ini»LAn>A» 4«j-45«.,l!ir - ■! 20 - 
MeivAGR 16 1"» 4*«)46o, Difi »i»8-4 



14-fiYDK-M'n"!. lix-iB<j,Siff.-!a> I : I : j 
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Now sine® th© shorter key has shifted one letter to the left in - 
cycle 2, the letter G can be placed next to Z on the shorter key in cycle 
1 « So q (3) of Fig, 7o If the letter in the second position on the shorter 
key in cycle 1 is G, in order to produce cipher N from plain text 4* the 
corresponding letter in the sane cycle on the longer key must be V« See (4) 
of Fig 0 7» 1% may now place 7 next to A on the longer key in cycle 2, See 

(5) of Fig. 7o 

In order to produce cipher letter S from plain text M in conjunction 
with V as the letter in the longer key, the second letter on the shorter key in 
cycle 2 must be U. See (6) of Fig, 7, Vife may now place U next to G on the 
shorter key in cycle 1, as shewn in (7) of Fig„ 7, and find the corresponding 
letter on the longer key. It is 2 0 See (8) of Fig, 7o 

The process set forth is continued, resulting finally in the re- 
construction of a double key xiiich will produce from the cipher 1 letters given 
in both cycles the correct corresponding plain texto Thus; 

Longer key = A V 2 X 7 H? 

Shorter key - Z G P Y D G X 
Cycle lo Cipher - - - G N U Q R X 5 
Plain text -4425A6M 

longer key ° A V 2X7 M 7 
Shorter key - G U Y G G X W 
Cycle 2o Cipher — - - 2 S 4 W P W N 
Plain text - 6 M 5 U H L E 

We may test the correctness of these keys by applying thou to 
cycle 3« Thus; 

Longer key = A 7 2 X 7 H ? 

Shorter key - U Y D G X W 
Cycle 3 Cipher - - - S E 4 Y K I 
Plain text - E R A L. L Y 

Vb see here the ending of a word like GENERALLY and we may feel 
sure of our keys 0 

Now in the reconstruction of our keys above, we began arbitrarily 
with A as the first letter in the longer key 0 life might have begun with any 
other one of the 32 possible letters of which the cipher square is composed, 
and thus build up anoth® pair of keys which, though in external appearance 
althogeth® different from the pair recovered above, would serve just as well 
as the lattero 3h short, it is possible to derive 32 different pairs of keys. 
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any pair of T £iich might be th3 original pair, but since all pairs give 
equivalent results, it will be unnecessary to find out which pair was 
really the original . 

In the preceding example, the decipherment of superimposed 
portions of cycles 1 and 2 was given, it havirg been stated that vs should 
disregard for the mommt the nuestion of hot? this decipherment was procured* 
We shall now proceed to the next step, which is to decipher are! reconstruct 
the keys simultaneously, given no decipherment whatever to start with* For 
this ease we shall, show the steps in the actual solution of a problem inhere 
only five messages have been intercepted. Since the principles to be eluci- 
dated require but a small part of a large* bo^y of text, it will not be nec- 
essary to give the whole of each of these five messages. V& shall stow first 
merely the key indicators and the length of each message. 



SET INDICATORS AND LENGTH OF MESSAGES, 

1 . O&MIJQ. Length, 610 letters. 

2. 670=66 0. Length, 555 letters. 

3. 225-2l6o Length, 482 letters. 

4. 707-698. L®igth, 364 letters. 

5 . '591-583 • Length, 572 letters. 



Assigning keys of 1,000 and 999 letters, we may indicate graph- 
ically the relative positions in which these messages will fall by a diagram 
such as that shown in Fig. 3. Si this diagram vs show exactly where each 
message begins and ends, what the key indicators are, etc. We can take for 
experiment any vertical section of these superimposed cycles. Let us take 
the section consisting of 25 letters in each of messages 1, 2, 4 and 5 as 
indicated by the serrated lines in Fig. 8. This diagram shows that letters 
1 to 25 of message 1, 391 to 416 of messags 2, 354 to 379 of message 4 and 
470 to 495 of message 5 fall within this section, \b therefore take those 
letters from our messages. They are as follows? 

Message 1 . Letters 1-25 0 



5I27C 3RNK6 R732A J40X6 GJ0AJ 
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Message 2 0 Letters 391“416® 

5JBQB G3L77 D7SV2 BT7IR 50BRG 

Message 4® Letters 354“379® 

XCHLT JQJUH VJA5C3 VMF ST7UX 

Message 5® Letters 470-495® 

CXURW K3?*2Y P7CSJ2 . GVRH? 26NTR 

Let us place these four portions directly beneath one another.. 

Thus: 



FIG. 9® 



Cycle 1-5I27C 
Qycl© 2 - 5 J B 0 B 
Qyde 3 - X C H L T 
Cycle 4 - C X U R t» 



3 R 8 K 6 R 7 2 Q A 
G 3 L 7 7 P 7 S V Z 
JQJUH ;U 5 C 3 
K 3 Z 2 Y F 7 0 N 7 



J4UX6 CJOAJ 

BTVIR 50BRG 

if If M B F S T 7 U I 

GVRNP 26NTR 



How if we can find the plain text for the series of letters 
which fell directly beneath one en other in cycles 1 and 2 we can begin 
to reconstruct the keys. It becomes a question therefore of assuming 
the plain text for the first few letters of cyles 1 and 2, recovering 
the keys upon the basis of such tentative decipherment and then testing 
them upon cycles 3 and 4o If the tentative decipherment is corrects the 
application of the double key to cycles 3 and 4 must result in the pro~ 
ducfcion of intelligible text. If such a result is not attained then it 
means that the tentative decipherment upon which the recovered double key 
is based is not correct, and we proceed to try a different tentative de=» 
cipherraent for cycles 1 and 2. The incorrect assuaption can involve ei~ 
thereor both of the series of tentatively deciphered letters. Obviously, 
if we can be certain of the decipherment of one of the series we will be 
on surer ground end will have to modify our assumption only for the other 
of the series when our trials of recovered keys prove the tentative de~ 
ciphermont to be incorrect. How the beginning of nearly every message 
can be assumed to be 4425, in order to insure a proper adjustment of the 
receiving machine. let us begin therefore by assuming that our message 
1 starts xvith 4425 , and since the portion of this message ^lich falls 
within the section to be analyzed contains letters 1 to 25, we may insert 
tentatively the decipherment of the first four letters of message 1 as 
4425® Then let us assume for the moment that the portion directly beneath 

« 13 *» 
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3a message 2 consists of a ssrias of 3’s, reconstruct the keys for these 
two portions (as illustrated in Fig. 7) and test them on cycles 3 and 4o 
Ths result of these steps is shorn in Fig. 10. 

FIG?,, 10 

longer key ■» A S R 4 

Shorter S©y » H OR I 

Cycle 1. Cipher - 5I27C3HN etc* 

As sums d plain text <=4425 

longer key - A S E 4 

Shorter key « 0 R Q H 

Cycle 2. Cipher »5JBOBG3I< etc 0 

Assumed plain text ” 3 3 3 3 

Longer ley - A S R 4 

Shorter ley - R Q H 

Cycle 3 Cipher - XCHLTJQJ etc. 

Resultant plain tex±~H M R 

longer key ■» A S R 4 

Shorter key - Q B 

Cycle 4o Cipher <"CXUR’7K3Z etc. 

Resultant plain text=G fl 

These results prove that the assumption of a series of 3 s s for 

the beginning of cycle 2 is incorrect* since the letters given for cycles 

3 and 4 fora unintelligible text. Vie therefore try out another probable 

* 

combination for message 2* such as KS3 s retaining as our decipherment of* 
the corresponding portion of message 1 the combination 4425# and see what 
result this gives. A list of the polygraphs which would recur most fre^ 
quently* and vhieh would be tested in conjunction with 4425 for message 
1* is given in the following tables 



33333 


30F3T 


my? 


3WIT 


3THE3 


ATI 


HA- S*R . 


D3TH 


3 AND 3 


HAT 3 


VER 


S3 au 


ING3 


EST3 


IT”3 s H 


S3TH 


ERE3 


HE(3)S 


T3TH 


TER (3) 


3THA 


TI0N3 


3 ARE 3 


RE(3)A 


ENT 3 


b&b 


N3TH 


6153 


HE(3)R(3) 


H3S3 

3®3 


3ALL3 


6N53 



The successive trials take very little time* since the correct- 
ness of any trial is speedily proved or disproved by applying the resultant 
keys to cycles 3 end 4. In this case* the trial of the polygraph 30N3 re~ 
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suits in excellent combinations in cycles 3 and 4» Thus? 

FEo n 0 

longer toy •*» A S P M . 

Shorter tey - H 0 P A 

Cycle lo Gipfosc* »5?2 7C 3RH etc. 

An aimed plain text -4425 

Longer fey = A S P M 

Shorter fey - 0 P A ? 

Cycle 2n Cipher “5JBQBG31 etc* 

Assumed plain text - 3 0 N 3 

longer fey - A S P M 

Shorter key «= P A 7 

Cycle 3<> Cipher - XCHLTJ Q J etc 0 

Resultant plain text -442 

Longer fey “ASP! 

Shorter fey *» A 7 

Cycle 4° Cipher - CX0RIHK3Z ete 0 

Resultant plain text = C 0 

It is evident that in cycle 3 we have struck a "carriage return 
and lira feeds” in eye 1® 4* vj® probably have a word beginning with CO, and 
w® can try to build upon this digraph &uch words as suggest themselves, as 
the fbl lowing; 

code cam® contract 

COLUMN COBS* ANY CONVOY 

COLLECT CONDITION COPY 

COME CONNECT CORRECT 

COMING CONSIDER COST otco etc 0 

It way take considerable tin© to test out all of the words 

vtiich suggest themselves, but it is only the start vohich is laborious, 

for after this the messages almost solve themselves.. Let us see what 

( P 

happens when we try COMMAND „ Given ( ? in cycle k» the blank letter is 

( U 

( M 

Fo This enables us to place F beneath M in the lower key in cycle 3, and 

(M 

gives A as the plain text letter „ Given (? in cycle A, the blank letter is R« 

(R 

(M 

T/Iih these additional lower fey letters in place throughout 
cur desi herrasnt we have the foUovdng: 
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F3Bo 22 



Cycle Xc 



Cycl© 2 0 



Cyels 3 



Cycle 4 



Song or key »A8PH 
Shorter key - HOP A ?FK 

Cipher <=* 5 % 2 7 C 3 R 0 ete 0 
Assumed plain text = 4425 

longer kay A S P M 



Cipher - HB0B03I* @te« 
Assisted plain t®ct 3 0 0 3 



- A S P U 

Shorter key - P A 7 P R 

Cipher - fCHL T JQJ etc 0 
Resultant plain text «**• 4 4 2 A 
\ 

longer key » AS P M 
Shorter tey => A 7 F R 

Cipher » C X U B H 3 Z etc. 
Resultant plain text » C OMMAND 



We are now reedy to determine the next letter in ths longer key* In 

(? 

the eolumai headed by the letter to be sought s in cycle 1 we hare (? ; in 
(? (? (C 

cycle 2„ (F § in cycle 3 , (R * (? 

(B (T 

(? (? 

It is evident that we want such a letter in the upper key as will produce the 
best plain text letters ftom the given cipher letters to add to ths already 
deciphered t®ct a W© could try out all the letters of the alphabet in fcum 9 
beginnii^ with Aj> thus? 



If A is the 
up par kay let- 
ter then 

If B is the 
upper key let- 
ter then 

If C is the 
upper key let- 
ter then 



(A (A (A 

in cycle X 9 (? s Fj in cycle 2 S (F s Qg in cycle 3 9 (R s B 

) (C (B (T 



(B 



(B 



(B 



in cycle X 9 (? sOj in cycle 2 9 (F « Fg in cycle 3 S (R » A 

(C (B (T 

) (C (C (C 

in cycle 1 9 (? » 7j in cycle 2 9 (F bsGj in cycle 3 (R « H 

(C (C (T 

etc* etc* etc. 



A short cut to the finding of these successive equivalents is 
accomplished by the use of the alphabets of the cipher square cut apart and 



mounted upon strips* It will be noticed that the successive equivalents for 

the combination c in cycle 1 are F 9 Q, 7 9 * * * . g for the combination 3 

R 

in cycle 2 9 Q # F 9 G s « * „ * 5 for the combinaticm ^ in qycle 3 S B 9 A, H s 



0000© 



not© the alphabets in the cipher square headed by the intersect 

7 F R 

tion letters of the combinations q sq aftd^, p viz<> 9 C 9 H fl and G s respectively* 



In the C alphabet the sequence begins F p Q 9 7 9 „ » *'» It is evident that this 
alphabet will give the complete sequence of letters resulting from the application 
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of the successive letters of the alphabet to the combination q ° The H 

alphabet, will likewise give the complete sequence of letters resulting from the 

F 

application of the successive letters of the alphabet to the cochin at ion BS 

R 

and the G alphabet will give those applying to t° Therefore* if ve take the 
alphabets of the cipher square* cut them apart* mount them cm strips* select 
those headed by the letters C* H, and G* and set them so that the letters of 
all three coincide throughout their length* we have the complete series of 
letters resulting from the application of the successive letters of the alphabet 
to these combinations 0 The successive letters or equivalents of this operation 
will all be found on the same tsorisontal lines. By setting the 7 alphabet oppo- 
site our strips* tho letter in the longer key necessary to produce the equiva- 
lents which fall on the same line will be indicated on the 7 alphabet at the 
same time* as shown in Pago 13 ° 

FIG, 13o If the high frequency letters appear in red on these strips* 

7 C H G vi<b can begin by selecting that horizontal line which contains all 
AFQB 

B Q F A red letters. In this case* with V as the letter in the longer key 
C 7 G H 

D U X W for tho column under discussion, the three high frequency letters, 
EKI6 

F A B Q T* R* and 3 are given. These* added to our partial decipherment * 

G H C 7 

H G 7 C give the followings 
I 4 L M 



J S 5 z 




FIG, 34 






X E 6 Y 










l M I 4 


- 


Longer key 


cs> 


ASPMV 


M L 4 I 




Shorts” key 




H 0 P A 7 F R 


HOP 


Cycle 1 


Cipher 




5Y27C3RK etc. 


0 P H 2 




Plain text 


■= 


4 4 2 5 T 


P02H 










QBiP 




longer toy 


- 


ASPMV 


r 3 V T 




Shorter key 


(3 


0 P A 7 F R 


S J Z V 


Cycle 2o 


Cipher 




5 J B 0 B G 3 L etc. 


T V 3 R 




Plain text 


C3 


3 o w 3 R 


U D VI X 


. 








VTE3 




longer key 


css 


ASPMV 


W XUD 




Shorter key 


*= 


P A 7 F R 


% W D U 


Cycle 3, 


Cipher 


«a 


XCHLTJQJ etc. 


Y 6 E K 




Plain text 




4 4 2 A 3 


Z 5 S J 










2 N P 0 




Longer key 


CO 


ASPMV 


3 R T V 




Shorter key 


«r* 


A 7 F R C 


k I ML 


Cycle 4o 


Cipher 


e=» 


CXURWK3Z etc. 


5 Z J S 




Plain text 


CO 


COMMAND 



6 Y K E 
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(• 

In cycle 4 we have (W v«rhich gives C as the corresponding Xet~ 

(A 

ter in the shorter key s as shorn already in Fig„ 14». may try out in 
cycle 2 the letter E after R 0 This 'would give Z as the letter in the longer 
key for that column <> Applying Z to all the eonfeinations in this column s use 



have the followings 



FIG 0 15 

Longer kBy 
Shorter key 
Cipher 
Plain text 

Lcnger key 
Shorter key 



A S P tt V Z 
HOP A7FRC 
5I27C3RN etc, 
4 4 2 5 T 0 

A8PH7Z 
OP A7FRC 



Cycle 1« 



Cycle 2c 



Cycle 3o 



Cycle 4« 



This gives the letter in the longer key which applies to that column s viZo S 33 
and this* in tum<, gives the plain text letter C following E in cycle 2 S risking 



Cipher - 


5 


J 


B 


0 


B 


G 


Plain text - 


3 


0 


N 


3 


R 


E 


Longer key « 


A 


s 


P 


M 


V 


Z 


Shorter key 


P 


A 


2. 


F 


R 


C 


Cipher - 


X 


C 


H 


L 


T 


J 


Plain tact - 


4 


4 


2 


A 


3 


H 


Longer key - 


A 


S 


P 


M 


V 


Z 


Shorter key - 


A7 


-F 


R 


C 


L 


Cipher 


C 


X 


U 


R 


w 


K 


Plain text 


C 


0 


H 


M 


A 


N 


begins with TO- 


, and we 


may 



it probable that the word is RECEIPT or RECEIVING or RECORD etco Thuss 



Cycle 1„ 



Cycle 2 0 



Cycle 3» 



Cycle 4» 



FKo 16 0 



longer key =ASPMVZ3 
Shorter kay - H0PA7FRC 

Cipher - 5 I 2 7 C 3 R N etc„ 
Plain test - 4 4 2 5 TO 3 

Longer key »ASPMVZ3 
Shorter key °0PA7FRC 

Cipher - 5JBOBG3L etc<, 
Plain text -= 3 0 N 3 R E C 

Loiter key “ASPKVZ3 
Shorter key <=• P A 7 F R C 

Ciphsr XCHLTJQJ etc. 
Plain text 4 4 2 A 3 H 



Longer key — 
Shorter key - 
Cipher - 
Plain text <= 



A5PH7Z 




C X U R W 
COMMA 



K 

N 



3 

3 

D 



Z 



etc 0 



= 18 - 



REF ID : A4148948 



(Z 

Pros th© combination (? in cycle 4s X* is givsan as ths letter in the 

(K 

(N (3 

shorter key, which, in turn, in cycle 3$ in (L , gives ths plain text letter E, 

(Q 

o 

suggesting the word HEAVY* T& can test out the words which suggest than-* 

o 

selves in cycles 2 and 3> and see what we get in cycles 1 and 4| or we can 
test out the words which suggest themselves in one cycle by applying the 
resultant key letters to any other cycle at the proper point* 

Enough of the procedure has been shown to prove that the method 
is perfectly practicable* If 4425 tried out at the beginning of the message 
does not yield good results, there are many other places to try out the same 
combination further along; for this combination, 442, must appear at inter= 
vals of approximately 55 to 70 letters* Or, this failing, the end 3 of messa=» 
gas can be tested for 6i|5, i» e*, ^period*" Should the decipherer be fortunate 
enough to find two messages which begin within one or two letters of one 
another in sequent cycles, then it will b© unnecessary to assume any plain 
text other- than 4425 » (&», if he should find that the beginning of one message 

falls within th© seme section as the end of another, the plain text will b© 

4425 and 6M5* When a place is reached where the proper continuation of the 
massages is difficult by reason of the failure of the preceding text to sug<= 
gast the succeeding text, recourse is had again to the alphabet strips* 

It is to be noted further that these alphabet strips may be used 
to find the letters in the shorter key as well as those in the longer key* 

The arrangement of the messages into sequent eycles is such that the letters 
of the shorter key are similar on diagonal lines* Given the letters of the 
longer key and the cipher on a diagonal line, one proceeds to set the strips, 
applying the sane principles as before, remembering only to add the hi^h 
frequency combinations found diagonally on the. strips in the messages as 
arranged for decipherment* The letter opposite the high frequency com- 
bination on the 7 alphabet, will be the diagonally constant letter of the 
shorter key* 

The complete decipherment together with the double key for these 
partial massages is shown in Fig* 17o 
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FIGc 17 . 



Longer Key 
Shorter Key 
Cipher 
Plain t®ct 



-ASPMV7. 3EK70JUALIRBGU3HWFD 

- HOPA7FRCIPPEKZTUHPA3PLF7A 

- 5I27C3RH6R72QAJ4CX C.C J 0 A J 
-4425T03ALL3RESERVE30FFICE 



Longer Key 
Shorter 
Cipher 
Plain tact 

Longer Key 
Shorter Key 
Cipher 
Plain text 



ASPM?Z3EK70JWALIRBGU3H!7FD 

OPA7FRCLDPEKZTIIMPA3PLF7AV 

5JBOBG3L77D7S7ZBTVIR50BRG 

30H3RECE1PT3.0F3AN30RDER3F 

ASPM7Z3EK70JRALXRBGV3HT7FD 
PA7FRCLDPEKZTUMPA 3ULF7A.VC 
X C H L T J'Q J U H if A 5 C 3 W T SBFST?Uf 
442A3HE A7I3B ARR AGE30N3THE 



Longer Key 
Shorter Key- 
Cipher 
Plain test 



- A S P !! f Z 3 E K 7 0 J H A L I R B G U 3 H "i F D 
“ A7FRCLDPEKZTPMPA3ULF7-AVC2 

- CX DR RK 3 Z 2 IF 7 0 H 2 fl V R N P 2 6 H T R 
= C0 1!MAHDIKG36WWI5TH3MINEV/E 



We have seen that the knowledge of the length of the key was 
necessary in order to arrange the a® s sages in the preceding case for ds- 
ciphermento Granting that the lengths of the tapes bearing the keys would 
be changed from day to day, and that "breaks n between messages would be mad©, 
it would nevertheless be an easy matter for the eneii ay to superimpose cycles 
correctly a without a knowledge of these lengths or these "breaks", sine© 
the key indicators which must accompany each use sage afford ampLe data 

for the pLacemant of messages 0 For instance in the preceding case we can 

/ 

determine the cycles to which each message belongs relative to the first 
message, merely by finding the difference between the key indicators for 
the several messages, though we may not know how much of a message is to be 
found in one cycle and how roach in the next cycle „ Thus, the indicators 
for massage 1 are 060 and 0$0, the difference being 10 0 Those for messags 2 
are 6?0 and 660, the difference also being 10 0 Therefore, the beginning 
of the second massage is in the sane cycle as ih© whole of message 1 0 Ths 
indicators for message 3 are 225 and 216, the difference being 9o This shows 
that message 3 ® with respect to message 1, is in cycle 2; since in the first 
message the two key tapes are 10 letters apart as regards their points of 
origin 0 and in the third message only nine letters apart 0 How the difference 
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between 225 and 060 is 165 o So that we may place the first letter of 
message 3? which belongs to cycle 2 S under the 165th letter of message 1 0 
We can now fit in the portion of message 2 which belongs in the second cycle*, 
since we note that the placement of message 3 allows room for 225 letters of 
message 2 in cycle 2*, leaving 330 letters*, which will be exactly enough to 
fill up 1*,000 letters in the first cycle* However c we do not need to do even 
this mdti s for we can work with beginnings of messages* Thus*, given the 
following series of key indicators for as many messages*, they can be arranged 
as shown in Fig* 18* 

MESSAGES 



Mess- 


Indicators 


Diff- 


Cycle 


Mess- 


Indicators 


Diff- 


Cycle 


age 


• 


erence 


1 


age 




erence 




1 


420=385 ' 


35 


1 


14 


212-189 


23 


13 


2 


430-399 


31 


5 


15 


517-483 


34 


2 


3 


320-291 


29 , 


7 


16 


476-456 


2D 


16 


4 


755-729 


26 


10 


17 


706-68? 


19 


17 


5 


830=802 


28 


8 


18 


468=450 


18 


18 


6 


103-079 


24 


12 


19 


316-299 


17 


19 


7 


465-433 


32 


4 


20 


011-994 


16 


20 


3 


001-978 - 


21 


15 


21 


050-035 


15 


21 


9 


670=643 


27 


9 


22 


200-186 


14 


22 


10 


210-177 


33 


3 


23 


286=273 


13 


23 


11 


035-010 


25 


11 


24 


095“$S3 


12 


24 


12 


212-190 


22 


14 


25 


001-989 


11 


25 


13 


516-486 


30 


6 











There are several points wlwe an attack may be marie*, vhen the 



messages are arranged as shown in Fig* 18* Both keys may be recovered com- 
pletely or nearly so* Ho matter how the key indicators may be used*, given 
a sufficient amount of intercepted traffic*, enough text can be obtained to 

make it possible to arrange the cycles with refer® nos to one another so 

<■ 

that a solution may be achieved* The cryptographer is guided by the key 
indicators in his arrangement of mes sagas preparatory to decipherment and 
not by the order in which they happened to have been sent* 
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ADDENDUM I. 

V 

OPINION BASED UPON. THE SIGNAL CORPS 9 NOTIFIED METHOD CF USING 
THE A. Tc & To MACHINE CIPHER, 

Th© purpose of this memorandua is to set forth our opinion, with the reasons, 
that ths A, To & To usehine cipher as now used by the Signal Corps is decipherable 
by the same principles as already established and as already admitted to be effect 
tive by the representatives of the M e lo Do and the Signal (hr pa® 

The following is a transcript of the rules for the operation of the machine 
for cipher purposes, as set forth in a pencil memorandum by It, Col* JoOJIanbargne 0 

Order of Punching Tape 0 

10 line feeds 

6 letters representing of. .tape -asttia^ 

as PPPTOT (SX)5 25) 



During Capto 
FowLor 8 s time 
enciphering began here, 

latter or letters designating cipher office, as "X" , B NP M etc. 
Figure shift (6) 

Cipher bureau serial number of message 
Space (3) 

Figures (6) 

Clack or ward count In raxmarals . 

Letters — line feed (5-2) 

Place from =— ~ 

Date 

Tin© filed 

Carriage return *—> Hm feed# 

Early 1919 
Enciphering 

begins 

Bfeme — address body of massage — signature 
Enciphering ends, 

(be line feed — 15 carriage returns. 

Note <=— Tapes A and B vary in length spending upon number of letters 
to be sent in one dsy, For ejsampla, w© night use TOO on the A tape 

and 699 on the B, or 650 on the A tape and 365 on the B, etc, 

/ 

**■&*■»• 

The differences between the original method and the modified method of 
using the machine can be summarized as follows* 

ORIGINAL METHOD MODIFIED METHOD 

TAPES 

I, Qia tap© is or© letter 1» One tape may be any number 

longer than th© other taps, of letters longer tten the oth®* tape, 

2o Ths number of letters in 2» Th® tapes vary from day to day* 

each tap© is constant from day to day. 
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SHIFTING THE TAPES 



- 3 0 The tapes are eith^* 
not shifted at all between 
messages or are shifted together 
the same number of letters,, 



3„ The tapes are shifted an 
unequal number of letters after each 
messages For example* the A tape 
may be shifted 10 spaces* the B tape 

14» 



BEGINNING OF ENCIPHERED MESSAGE 

4„ Each message begins with 4o The enciphered portion of message 

the functions represented by 4425 o begins at once with the name and address 

of the person to #iom the ires sage is sent® 

USE OF FUNCTION AND PUNCTUATION 

5o All functions and 5 » Sons functions and punctuation nay 

punctuation are used as in or nay not be used* i„ e„* there may be spaces 

ordinary typewritten matter o (3) between words* commas (6N5)» paragraphs 

(A4233333) etc.* with the exception of (442) 
which is absolutely necessary for the function- 
ing of the machine,, 

W& shall now stow that these differences as set forth above do not change the 
nature of the cipher in a manner so as to prevent an attack by exactly the 
asms principles as elucidated before* first* because it is unnecessary to know 
either the lengths of the tapes* or by how naich they differ* secondly* because 
the shifting of the two tapes an unequal number of letters has no bearing upon 
tha case at all* third* that even should the encipherrasnt begin with some unknown 
text and not with the functions 4425 that there is a sufficient nunfcer of possi- 
bilities to try out in other places? and fourth* that the presence os? absence of 
certain functions and of punctuation may make the problem a little more difficult 



but by no means unsolvahleo 



lo THE TAKES . 

In order to eliminate ' ail ambiguity we shall define the vord "cycle" 
and the phrase "sequent cycles" as follovis: 

(a) CYCLE 0 T^at relation which exists between the two key tapes after 
one tsqpe has made one complete revolution 0 Cycles may be measured by either the 



Ion? 



sps or the shorter tape* and in our work we hare used the longer tape as 



the measure of a cycle,. 



(b) SEQUENT CYCLES 0 Two cycles are sequent when the longer tape occupies 
tbs same absolute position in both cycles and the shorter taps is displaced one 



and only one latter in one cycle as compared with the other,, Sr all the drawings 
and figures this displacement is to the iefto Whan the key indicators for on© 
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nssssags differ by an amount, X, and those for another massage differ by 
X f 1 op X = 1, than we have a case of sequent cycles* THh®n the lengths of 
the key tapes ar© unknown this difference must be expressed in terms of 



either a positive or a negative quantity,. Example : 



indicators 075 



125 s difference s ~50» 



indicators 125 “ 075s difference a * 50« 



3h the original method the knowledge that the two tapes differed by hit 
one letter in length enabled us to say that sequent cycles represented a dis- 
placement of the shorter tape of but one letter each time* This, in turn means 



that se 



with sequent 



other words,, a progress! can from say the end of the second revolution to the sad 
of the third resolution means a progression of one complete cycle and represents 
a displacement of one letter of the shorter tape* 

If the tapes differ in length by more than one letter, for example, if 
the two tapes differ by 50 letters, then the displacement of the shorter tape 
will be 50 letters per rwoli&ion of the longer tape, in which ease it is dear 






s of 



not co 



Fig* 18 and the discussion applying to it shows clearly that these messages 
were superimposed by raf@r@nc© to th® key indicators only,, The crucial point is 



this, that in the solution of a 



long message a knowledge of the lengths of 



the key tapes is absolutely essential; without this knowledge the length of a 
eyel© and the displacement in sequent cycles never can be determined, which in 
turn means an inability to superimpose cycles so that the principles of solution 



can be applied* But in the solution of a s« 



of messages a knowledge of the 



lengths of the key tapes is entirely unnecessary, since sequent cycles are 
determined not from such a knowledge but solely ftpom the key indicators for 



the respective messages* The displacement in sequent revolutions may be any number 
of letters, a matter of no concern to us, but the displacement in sequent 
cycles (according to our definition of the phrase) is allays one letter, and 
there can b© no doubt that that messages in sequent cycles can be found, as will 
b© illustrated below* To sum up, therefore, a knowledge of the lengths of the 
two tapes is entirely unnecessary for the sip or imposition of cycles, preparatory 
to decipherment of a series of mss sages* 



■3 
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2„ PA3LY VARIATION IN LENGTHS OF TAPES n 

Ths fact that there is a daily variation in tte lengths of the tapes in 
tte modified method as coup a red with a constant length in the original method 
has no bearing upon the case because as stated in the preceding section,, a 
knowledge of the lengths of the tapes is unnecessary for the solution of a 
series of messages, and secondly, because the fact of constancy in tl© lengths 
(as wa a the case in the original ssethod) is par se of no importance in such a 
solution,, 

3o SHIFTING- THE TAPES . 

The shifting of the tapes, together or singly, equal or unequal distances 
in all instances has no bearing upn the case, becmise 3uch shifting does not 
preclude the possibility of the occurrence of sequent cycle s 0 As a matter of 
fact B the unequal shifting of the tapes, after each message,, is a highly danger- 
ous procedure because it makes possible the accidental encipherment, of two mes- 
sages by an identical resultant simle key, i. e 0 , such proceeding introduces 
many possibilities of "overlaps Every case, in which the difference between 
the key indicators is the sac© represents a case of ai "overlap",, 

4° functions eliminated at beginning . 

The fact that in the original method messages began to be enciphered with 
the iUnetions U 425 only eliminated the necessity of assuming plain text for the 
beginning of a message, i s ©„, if we kno’-v that each message begins vdth 4425® the 
trial, of the most frequently recurring polygraphs in ths corresponding position 
in the next sequent cycle is all that -is necessary to get a start,, H ovfever, in 
the modified method there remain many otho? points of attack, for the encipher- 
ment begins with a name and an address,, This must contain, in military messages, 
titles, initials, punctuation and functions such as figure and letter shifts, 
period, spaces,, All of these afford easy openings for attack, especially in 
view of the fact that the sending and ths receiving stations can be determined 
with a fair degree of probability 0 

• 5o ELIMINATING PUNCTUATION etc 0 

The elimination of all punctuation, and such functions as space and paragraph 
would not complicate the solution any more than their .absence in ordinary cipher 
messages does,, However, the functions 442 (carriage return and line feed) are 

-4 - 



\ 
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absolutely necessary fox* the proper operation of the machine and therefore their 
elimination is iapossitiL© 0 T^a length of lines is not highly variable in nature * 
and it is reasonably certain that in the body of the message th3 functions 442 
mist recur at intervals, appros&mating 60 letters „ 

The indicators aid lengths of the following series of 17 messages illus^ 
trat© the foregoing points,, This series of hypothetical messages was drawn up 
according to the rules as laid down in the iremorandun submitted by the Signal 

Gorp3 s md represent what happens in the traffic of only one station of possibly 

/ ' 

four* this station has been assigned one fourth of the length of one tape p in 
accordance with the plan set forth e The tapes for the day are 700 and 6?0 letters 
in length » Station 1 ha 3 bean assigned the region from. 001 to 160 on the shorter 
tapso At no time must the different© between the key indicators exceed 160 S other- 
wise Station 1 will b© encroaching upon the region assigned to another station., 
or as we shall ssy 9 ha will b© "out of bounds The data for this series of 
hypothetical messages ar@ as follows s 
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TAPES 
TOO - 670 



lo 



076 - 055 (a) 
361 - 361 (c) 
437 - £-6 (d) 



a (b) 



2o 442-417 (a) ^25 (b) 
206 - 206 (c) 

648 - 623 (d) 

3- 418 - 362 (a) =56 (b) 
368 - 368 (c) 

78 6 - 730 
700-670 (e) 
oarnfso (<o 




068 (a) 
_(c) 
*53 (d) 



22 (b) 



5. 



362 - 262 (a) ~ 100 (b) 
287 — 28? (c) 

§49^549 (d) 



6 . 



655 - 550 (a) s 105 (b) 
688 - 688 (c) 



1343 
)0 






=1238 
670 (0) 



.3 - 568 (d) 



7o 649 - 597 (a) - 52 (b) 
3Qi^iJ0 5_(c) 

954 - 902 
700 - 670 (e) 

254 - 232 (d) 



8. 259 - 232 (a) 

21=J21 K> 

582 - 555 (d) 

9 195 - 076 (a) 

PLz. ML (c) 

642 ^ 52J (d) 



27 (b) 



s 119 (b) 



10. 658 - 532 (a) - 126 (b) 
487 - 487 (c) 

1145 “1019 
700 - 670 (e) 

445 - 349 (d) 

11. 449 “ 385 (a) - 64 (b) 
508 - 508 (c) 

957 - 893 
700 - 670 (e) 

257 - 223 (d) 



12c 260 - 236 (a) - 24 (b) 

418 - 418 (c) 

■678 - 654 (d) 



13. 480 - 350 (a) - 130 (b) 

216 — 216 (c) 

6% - $(£ (d) 



14- 



698 - 571 (a) =127 (b) 
2$7 ~ 267 (c) 

9§5 ~ 838 
700 - 670 (e) 

2^5™-168 (d) 



35 o 272 - 170 (a) - 102 (b) 

208 - 208 (c) 

480 - 378 (d) 



16 . 



495 - 399 (a) = 96 (b) 

(c) 



911 - 815 
700 - 670 (e) 
211 - 145 (d) 



17. 225 “ 202 (a) ~ 23 (a) 

408 - 4 08 (c) 
TfT^blO (d) 



KEY TO EXPLANATORY MARKS; (a) Indicators at beginning of message*, 

(b) Circle as determined from their difference 0 

(c) Length of messages 

(d) Positions of tapes at end of message 
(g) Subtraction for length of tapes 0 
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ADDENDUM 2 



SUMMARY 

la this Addendum we shall shows 

a. how the test messages submitted by the Signal Corps were 
deciphered. 

b. that the present system, which employs key tapes dif- 
fering in length by more than one letter, is much more unsafe 
than the former method in which key tapes differing in length by 
one and only one letter were used. 

Co how the trials for possible plain test are reduced to 
simple terms, enabling a great number of trials to be made within 
a short time. 

d. methods of solving cases not involving sequent cycles. 

1. PRINCIPLES USED IN THE SOLUTION OP THE TEST MESSAGES 

It may be said at the outset that the principles which were 
involved in the solution were basically those set forth in the 
original manuscript and its Addendum 1. The steps were as 
follows : 



a. First, the plain text preamble for each message was 
read. This gave the key indicators, the serial number of the 
message, the number of words, the place of origin and date. Por 
example, the first message sent by the station at Hoboken gave 
the following preamble: 

EWWPPQA6Q53656QR52HQ3P30F3B3H0B0KBN3NJ3SEPT36WW36TRP55P442 

"Translated," this would read as follows: 

322 * 001 {Serles)A (No.)l l4(words) HQ P{ort) of E(mbarkation) 
Hoboken NJ Sept 22 5 = 40 P(M) 

Then the total number of characters in the message was 
determined by count, beginning with the character immediately 
following the 442 and extending to the beginning of the series 
of 2“s or 4 B s at the end of the message. 

By classifying the tapes in accordance with their points 
of origin, and then in accordance with their serial numbers, the 
following list resulted: 



List of Messages 



WASHINGTON SERIES 



Message 



S3 

o 

o 

1 


Indicators 


Length 


1 


126 * 001 


278 


2 


406 * 281 


321 


3 


729 * 604 


380 


4 


324 * 347 


213 


5 


539 * 562 


230 


6 


771 * 155 


276 


7 


261 * 432 


423 



Message 



No. 


Indicators 


Length 


8 


687 * 228 


491 


9 


393 082 


182 


10 


577 * 266 


438 


11 


230’® 06? 


252 


12 


484 * 321 


304 


1? 


002 * 626 


331 


14 


335 5 520 


484 





Indicators 
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Message 

No. 



Indicators 



15 


034 


e 


167 


314 


16 


550 


•» 


483 


341 


17 


695 


ft 


187 


237 


18 


145 


■ft 


426 


264 


19 


887 


* 


053 


333 


20 


746 




88 


281 


21 


242 


» 


632 


182 


22 


426 


ft 


216 


326 


25 


754 




544 


270 


24 


259 




177 


629 


25 


08> 


ft 


169 


1959 


26 


470 


* 


213 


228 


27 


700 


ft 


443 


304 


28 


219 


«• 


110 


437 


29 


658 


ft 


549 


308 


50 


181 


ft 


220 


481 


51 


664 


ft 


064 


214 


52 


095 


* 


280 • 


410 


53 


505 


«■ 


053 


254 


54 


698 


ft 


309 


236 


55 


212 


■li- 


547 


244 


56 


458 


ft 


154 


275 


37 


735 


li- 


431 


362 


58 


312 


ft 


156 


323 


59 


637 


ft 


481 


491 


40 


350 


ft 


335 


142 


41 


487 


•» 


479 


318 


42 


020 


■» 


160 


275 


43 


297 




437 


374 


44 


673 


o 


984 


206 


45 


094 


ft 


382 


378 



46 


474 


e 


123 


421 


47 


110 


•R 


546 


319 


48 


431 


ft 


228 


359 


49 


005 


-» 


589 


400 


50 


40? 


«• 


352 


326 


51 


735 


«• 


041 


582 


52 


532 


«• 


625 


273 


53 


020 


•» 


261 


309 


54 


331 


* 


572 


150 


55 


483 


-a- 


085 


403 


56 


101 


•a- 


490 


403 


57 


506 


•a- 


256 


378 


58 


099 


■» 


636 


783 


59 . 


097 


ft 


143 


492 


60 


591 


li- 


004 


221 


61 


027 


ft 


221 


381 


62 


408 


•& 


602 


237 


63 


647 




202 


327 


64 


189 


«• 


531 


295 


65 


486 


«• 


189 


300 


66 


001 




491 


195 


67 


198 


a- 


049 


424 


68 


624 


* 


475 


411 


69 


250 




259 


318 


70 


570 




579' 


262 


71 


047 




204 


161 


72 


210 


■» 


367 


208 


73 


420 


■& 


577 


202 


74 


624 


•a- 


142 


149 


75 


775 


« 


293 


133 



HOBOKEN SERIES 



Message 



No. 


Indicators 


1 


322 


© 


527 


2 


515 


■a- 


194 


3 


97 1 


ft 


089 


4 


460 




287 


5 


665 


«■ 


492 


6 


133 


ft 


108 


7 


364 


«• 


339 


8 


008 


* 


131 


9 


398 


•& 


521 


10 


770 


•» 


254 


11 


198 


«■ 


469 


12 


377 


«• 


009 


13 


624 


* 


256 


14 


733 


•» 


493 


15 


434 




214 


16 


711 


«• 


491 


17 


271 


•& 


199 


18 


451 


■» 


379 



Length 


Message 

No. 


191 


19 


532 


20 


195 


21 


203 


22 


253 


23 


229 


24 


429 


25 


388 


26 


3370 


27 


213 


28 


177 


29 


245 


30 


235 


31 


358 


32 


275 


33 


345 


34 


178 


35 


224 





Indicators 


Length 


772 


■& 


605 


• 294 


186 


■» 


971 


215 


403 


* 


479 


456 


733 


* 


298 


370 


446 


«■ 


031 


314 


762 


ft 


578 


407 


479 


ft 


117 


165 


552 


* 


285 


354 


121 


« 


002 


366 


489 




370 


751 


455 




484 


1089 


759 


* 


297 


396 


370 


•» 


056 


1200 


785 


•» 


619 


562 


942 




544 


523 


300 




430 


512 


027 




305 


495 



-2 
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KEVJ YORK SERIES 

y * 1 

Message Message 



Ho 


Indicators 


Length 


Ho 


Indicators 


Length 


1 


714 


a 


001 


157 


13 


576 


* 


002 


236 


2 


086 


«■ 


160 


307 


14 


714 


# 


240 


272 


3 


395 


a 


469 


235 


15 


201 


■-» 


514 


302 


4 


891 


a. 


067 


761 


16 


505 


a 


179 


235 


5 


6l8 


a 


1'91 


205 


17 


742 


a 


416 


231 


6 


038 


& 


398 


365 


18 


188 


a 


010 


276 


I 


405 


a 


126 


329 


19 


4l8 


a 


288 


284 


8 


736 


•» 


457 


577 


20 


752 


a 


574 


134 


9 


528 


a 


397 


316 


' 21 


101 


a 


071 


128 


10 


059 


a 


076 


585 


22 


231 


■a 


201 


133 


11 


646 


a 


024 


359 


2 ? 


366 




336 


143 


12 


220 


a 


385 


253 


24 


511 


•a 


481 


91 



NORFOLK SERIES 



Ho. 


Indicators 


Length 


~r. 

1 


518 


■a 


001 


514 


2 


247 


a 


517 


320 


3 


569 


* 


200 


271 


4 


055 




473 


274 


5 


331 


a 


110 


279 


6 


612 


a 


391 


388 


7 


' 215 


a 


142 . 


163 


8 


380 


a 


307 


139 


9 


521 


a 


448 


446 


10 


182 


a 


257 


677 


11 


074 


a 


297 


407 


12 


483 


a 


067 


227 


13 


712 


a 


296 


273 


' 14 


200 


a 


571 


279 


15 


48l 


a 


213 


195 


16 


678 


a 


410 


990 



- 5 - 
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b. Next, the lengths of the two keys were determined from 
a mathematical analysis of the foregoing lists. Consider, for 
example, the first few messages emanating from Washington, paying 
particular attention to the key indicators, and the length of each 
message. For ©sample, Washington 1 begins at 126 * 001 and 
contains 278 letters-*-. It is evident that at the end of the mes- 
sage the keys would be at points, hereafter designated as "loci,” 
27o letters beyond the original loci. Thus: 

Washington 1 .... 126 * 001 
Length .... 278 278 

4W*~279 



The key indicators for Washington 2 are 406 * 28l, two in advance, 
respectively, of the loci where Washington 1 left off. It is evi- 
dent that before beginning on the next message Washington 2, which 
has 522 letters, the encipherer "slipped” both key tapes two letters. 
Adding the number of letters here again to the key indicators, we 
have the following: 



Washington 1 
Length 

Slip 

Washington 2 
Length 



. 126 * 001 




Washington 3 begins at 729 * 604, in other words, after a "slip" 
of 1 letter in each key. 

Now Washington 3 has 380 letters. Let us add 380 to the 
key indicators. Thus: 

Washington 3 •••• 729 * 604- 
Length .... 380 380 

1109 * 984 



The result should correspond^ approximately with the key 
indicators for the next message, but Washington 4- gives as indica- 
tors 324 * 347 « It is evident, therefore, that both key tapes 
have completed one revolution and are 323 and 54 6 letters, res- 
pectively, beyond their initial loci, viz, 001. If now we find 
the difference between the theoretical pair of indicators, 

1109 * 984, and the actual pair, 324 * 347* we shall begin to 
approximate the lengths of the key3. Thus: 



Washington (theoretical initial loci 
4 (actual " " 



1109 * 984 




We begin to suspect that the longer key is about 783 
letters in length, the shorter, about 637. We must, therefore, 
determine not their approximate lengths, but their exact lengths. 
If there were no slip between Washington 3 and Washington 4, then 
the numbers 785 and 637 would coincide with the exact lengths of 
the keys. We do not know whether there has been a slip between 
these two messages, or, if there has been, whether the slip was 
the same for both keys. But we do not have to determine that 



-4/e shall use the word "letters" to Include all the characters 
and "functions" of the machine, as they appear on the cipher tapes. 



- 4 - 
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immediately. Let us turn our attention to a case in which only 
one of the key tapes completes a revolution within a message . 

For example, consider Washington 5 > with key indicators 539 * 562 , 
length 230 letters; and Washington 6 , with key indicators 771 * 155 , 
length 276 letters. Let us calculate as before. 

Washington 5 • • • » 559 * 562 



If there has been a slip of two letters on both key tapes, 
then Washington 6 should begin at 771 9 794. But in reality, the 
key indicators for this message are 771 ® 155 . Still assuming an 
equal slip of two letters, then locus 792 + 2 = 794, which coincides 
with locus 155* Taking the difference, 794-155 — 639* which would 
be the exact length of the short key. Above, we had determined 
the approximate length as 637 » 

Applying the same process to determine the exact length 
of the long key, taking Washington 6 and 7 for calculation, we 
find the following: 

Washington 6 .... 771 * 155 
Length .... 276 276 

1047 431 

Washington 7 begins at 261 * 432. Since the indicators 
as regards the short key differ only by 1, we assume an equal slip 
of 1 for both keys. Therefore locus 1047 ■+•!*=• 1048, which coin- 
cides with locus 261. Then, likewise, 1048-261 — 787 , the exact 
length of the long key. Our approximate length was 785 , as 
determined above. 

It now remains to test these determinations on all mes- 
sages, their correctness being based upon the consistency with 
which the theoretical key Indicators for each message agree with 
the actual, taking Into account the assumption that the two key 
tapes were slipped an equal distance in ©very case. There may be 
a variation in the amount of slip between successive messages, 
but so long as in each case both tapes are slipped through the 
same distance, the result would be exactly the same as though each 
message were 1, 2, 3 letters longer than Is actually the case, 
with no slip whatever involved. A careful study of the calcula- 
tions which follow will show that there could not possibly be any 
doubt about the correctness of the two determinations, 787 and 639 ° 
There are several discrepancies, it is true, but they were due to 
errors, or carelessness on the part of the encipherer, as will 
be discussed later. 

Before giving the complete calculations for the series 
of messages, we shall Introduce into the discussion a feature 
which concerns what we have termed latent cycles . (For defini- 

tion of the ordinary cycle see page~ 2 "ofTddendma 1 .) 

Consider Washington 3* for example; It begins at 729 * 604, 
or In the 125th cycle and ends at 322 * 345, or In the minus 23rd 
cycle. The message Involves, therefore, at least two cycles. 

But there is in reality an additional cycle involved. For, after 
the message ha3 proceeded for 36 letters, the short key is at 
locus 640, which coincides with locus 001, since the key is 639 
letters in length. But while the short key is at locus 001, the 
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long key is at locus 729 36 , or 765- After the 36 th letter, 
therefore, the message proceeds In cycle 765-001, ox* cycle 764. 
This we term the hidden or latent cyele c In contradistinction with 
the open or patent cycles (which are shown by the key Indicators 
themselves), because the existence of th© latent cycle is dis- 
closed only by the calculations made as a result of the determina- 
tion of the exact lengths of the two key tapes. These relations 
can be demonstrated very simply, thus? 

Washington 5 . . . . 729 * 604 Cycle 125 

(length 380 letters) .... 36 36 

705 *" 640 

or 

765 * 001 Cycle 764 

But this message is 380 letters in length and continues 
to be enciphered after the 36 th letter. Proceeding for 23 letters 
more, the long key reaches the locus 788 , which is in reality 
locus 001, since the long key is 787 letters In length. The short 
key, after 23 letters, is at locus 024. The difference between 
the two loci 001 and 024 is therefore -23 a and the message is now 
proceeding in the latent -23rd cycle. It continues to do so until 
th® end of the message. These relations are summarized mathematic- 
ally in a standard form as follows? 




Indicators 



Washington 3 



End of Wash. 




Length 

Partial Total 


gj.cjg. 


36 


125 


23 


764 


321 380 


-23 



The calculations which apply to the entire series of messages 



are as follows? 












WASHINGTON 


SERIES 






Message 

No. 


Indicators 


keng 

Partial 


th 

Total 


Cycle 


1 


126 * 001 

278 278 
TO * 279 
( 2 2) 


278 


278 


125 


2 


322 322 

72g“^r~go3 


322 


322 


1 


3 


729 * 604 
7^5 * 60¥ 


36 
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4 

5 



6 



7 




9 

10 



11 



Indicators 



765 * 640 
765 * 001 
23 23 

78s * 084 
001 * 024 
321 




617 * 001 

152 152 



769^ 
( 2 



153 

. ,.£L 



•m -i'55 

17 ' 17 

78^172 
001 « 172 
2 ? 

"2? 

208 208 
48F' r W 
469 * 001 





57 

101 101 
tB8“* 329 
001 * 329 
.311 311 



230“ 



312 * 001 

J3 ~1 9 

391^080 
2 2) 

393 * 082 
182 182 
5Y5=r^ir 
I 2 2) 

211 211 

7E^~WT 

001 * 477 

163 163 

15? * ' 64o 

164 * 001 

64 64 

228^065 



2j 
7567 



Length 

Partial Total Cycle 



23 




764 


321 


380 


-23 


213 


213 




78 






152 


230 


616 


17 






259 


276 


-171 


208 






215 


4S3 


468 


101 






311 




-328 


79 .. 


491 


311 


182 


182 




211 






163 




-476 


64 


438 


163 
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Ho, 



Indicators 



11 



12 



13 

c 




14 



15 



16 



17 



18 



19 



20 



304 
7B8^ 

001 * 

14 14 

016 * 001 

2 ) 

35 * 320 
20 320 
55^W 




316 316 

fi)iri.'.i~UML.« j; 1 'll Ug> - 1 II 

350 * 483 
( 0 0} 
350 »'483 

12L- 
507* 

507 * 

184 




Length 

Partial Total 



252 


252 M 


304 


304 


14 




317 


331 


320 




133 

31 


484 


316 


316 


157 

184 


341 


95 




143 


238 


214 




50 


264 



Cycle 

—case Limjw 



-624 



15 



654 

“135 



506 



-281 



358 



333 333 



-8 




REF ID : A4148948 




21 



Indicators 

746 * 388 
42 42 

7 88 ^ 4 T o 
001 * 430 
210 210 
2li * 640 
211 * 001 
:29 29 

246 

2 2 ] 

W2 « 03J 
182 182 
424 * 214 



I 



22 



23 



24 



25 



?26 326 
732^5^2 
C 2 2) 

754 # 544 

34 34 

788 * 578' 

001 * 578 
62 62 
063 * 640 
063 * 001 

237 * 175 

±A^lliL 

239 * 177 
463 463 

762^640 
702 * .,001 



7B8~'S~58 f 
001 * 087 
80 80 

oBr— 157' 

c 2 Ji 



083* 

471 

5? 

554 * 

234 __ 

7§H 233 



26 




Length 

Partial ' T otal 
42 



210 



29 


281 


182 


182 


326 


326 


34 




62 




174 


270 


463 




86 




80 


629 



471 

234 

405 

382 

237 

211 I960 



Cycle 

-429 

210 



“577 

62 



701 

-86 



553 

-234 

405 

-382 

257 
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Message 

EjO* Indicators 



26 470 * 213 

228 228 




420 420 

6oi~3~65o 

601 * 001 




Lea; 

Partial 


life 

Total 


Cycle 

-ITy 


228 


228 




88 






109 




-530 


108 


305 


109 


437 


437 





91 

39 

175 


305 


748 

-39 


420 






56 


476 




124 






87 


211 


-187 


360 

46 


406 


452 


251 


251 




27 

206 


233 


-335 



-10 




REF 



Indicators 



35 



36 



37 



38 

39 



40 

41 



42 

43 



44 



212 * 547 



305 * 001 
1.48 148 



- AT 




788“^ 




001 * 


484 


156 


.156 


157 * 


mo 


157 * 


001 


149 


149 

t cn 



312 * 15& 
>23 32: 

•35 *479 
2 2 
37 * ^81 
151 151 

788“*' "632 
001 * 632 
8 8 
O09~^~b40 
009 * 001 

356 * 32 & 




W 

140 

W 5 T 

* 4 

rp* 

161 

648 * 
140 

w 

001 

12 - 



335 

140 

W 5 



«• 



XjEl 



020 



161 

“64o 

001 

140 

TTT 

141 

134 

6 ) 

W” 



500 * 001 
167 167 
667^168 

673 *174 







Partial^ * " Total Cycle 



93 






148 


241 


304 


272 


272 




53 






156 




”483 


149 


358 


156 


323 


323 




151 






8 




-631 


327 


486 


8 


140 


140 




161 






140 




647 


13 


314 


-140 


272 


272 




203 






167 


370 


499 
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45 



4? 



48 



49 



50 



51 



52 



Indi cators 

673 * 

11 5 

780 289 

001 * 289 
89 8 

090 * 3 

__4 

5? * 3 
258 2 
3#"^ 

552 

116 

468 






729 # 


035 


-1-8 


6 


735 * 


"o4x 


53 


53 


788 * 


094 


001 * 


094 




J22. 




Length 

Par tl&X Total 



115 




89 


204 


258 




116 


374 



314 



102 


416 


94 

221 


315 


355 


355 


51 




345 _ 


396 


288 




34 


322 


53 




523 


576 



15 

241 



Cycle 



-288 



351 



-436 



203 



-584 



55 



694 



“93 



546 
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I 




52 

cont 8 d. 



53-: ' 

54 



55 



56 



57 



58 



59 

60 



REF ID : A4148948 

i 



Indicators 



788 o 242 
001 * 242 
13 13 

5IT^255 

< 6 6] 

306 306 

^ JiL 

331 *572 
68 68 




399 9 001 
80 80 

WT^OBT 
* 4 41 



305 305 



001 * 390 
94 94 

6 — 61 



tnr^wcr 

150 150 

25l^T40 
251 * 001 
249 249 

it 1 i rtm^T Won im»i wt n rrmTiTu 

500 « 250 

C 6 6 ) 

506^256 
282 282 




4 4 

loj^ror 
103 9 001 
639 6: 



742 .* 

742 * 001 
46 46 

001 * 047 
86 86 

n * 143 

46 f 48' 




591^ 



Length 

Par tilTTo t a 1 



13 


269 


306 


306 


68 


\ 


80 


148 


30$ 




94 


399 


150 




249 


399 


282 




92 


374 


4 




639 




.46 




86 


775 


487 


487 



Cycle 

-241 



398 



-389 



250 



-537 



102 



741 

~46 



-13- 
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Message 

Ho. 



Indicators 



60 



61 



62 



63 



64 



65 



66 



67 

68 



591 * 637 
3 3 

594 * e >40 
594 * 001 
1 94 194 

7§T* 




001 *• 343 
182 182 



183^ 
' 6 
1W 

109 



525 
6) 
53T“ 
109 
298 * FfO 
298 * 001 
183 183 

5 

297 



5) 

TBlF 

297 

T86 



785 
001 * 491 

149 149 

150 * 001 

,_44 44 

i$jHr 




— -51 

T75^ 
164 1 64 

788^635 

001 * 639 
1 1 

002 *" 64 o 



Length 

Partial Total 



3 

194 



21 


218 


377 


377 


38 , 




197 


235 


141 




182 


323 



109 



183 


292 


297 


297 


149 


44 


193 



420 420 



164 

1 



Cycl e 

-«r*r,'ni»»min 

593 

-194 



445 

-342 

297 

-490 

149 



“638 



- 14 - 




REF ID : A4148948 



Message 

Moo Indicators 



68 

coated. 



69 

70 



71 

72 

73 



74 

75 




"047 '204 

159 159 

( 4 4) 

■si 

206 206 

416^57^ 
i 4 4) 

420~*“577 

63 62 



63 

W 




483 * 001 

S20 * ^4) 

24"4 W 
14? 147 

tti^M 

4 4) 



75 *293 

001 * 316 
120 120 



Length 

Partial Total 



242 


407 


315 


315 


61 




157 




42 


259 


159 


159 


206 


206 


63 




131. 


200 


147 


147 


13 




120 


133 



Cycle 

1 



630 



“157 



482 



-315 



-15 




- Cycle 

321 
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HOBOKBM SERIES 




2 



3 

4 

5 



6 

7 



Indicators 



322 * 


001 


191 


191 


513^ 


Tl§2 


I 2 


2) 


515 * 


l3%~~ 


273 _ 273 


788 


001 * 


467 


173 


173 


I74 * 


§40 


174 * 


001 


86 


86 

~n&r 



2 

ter 



59 

1 



TT 



*089 

“IS 



1) 

tr« 2b? 

203 203 

123 123 

?8 

001 * 615 

026 * 001 
105 10* 

L31 * 1( 

2 2 ) 
To8 




35r*' 

S OI 3 01 
^5*6^6 
665 * 001 
1 23 122 

78o rf? ”T2* 
001 * 124 



8 



9 



10 



006 

~lor 

388 

W~ 

4/ 



«• 



119 119 

517 * 640 
517 
251 

w 



"129 

131 

388 

W, 

2] 
521 




Length 

Par ti&lro tal 



191 


191 


273 




173 




86 


532 


197 


197 


203 


203 


123 




25 




105 


253 


229 


229 


301 




123 




5 


429 


388 


388 


119 




251 


370 



-466 

173 



-6l4 



25 



664 

-123 



516 
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Indicators 

770 * 254 
18 18 
788~ r “272 
001 * 272 



( 2 
19 

in— 
375 * 
375 * 
c 2 



Partial Total 



12 


377 * 


009 




24fj_ 


245 




6^2 1 r 


i tgf 




. . ( 2 . 


— 2 , 


13 


* 


T56 




164 


164 



001 * 420 

71 71 

*~W 
C 2 2] 

074^^9^ 
147 147 

22l~«~OT 
221 * 001 
211 211 
431^212 

C 2 ' 2) 

711 * 491 

7 

001 * 568 

72 72 
07T^T40 
073 * 001 



C 2 2) 

i,jY^~605 ~ 

712 * "6?o 
r 712 * oon 

76 76 

W^off 

001 * 07? 
183 183 



195 


213 


177 


177 


245 


245 


164 




71 


235 


14? 




211 


358 


275 


275 


77 




72 




196 


345 


178 


178 


224 


224 


35 




76 




183 


294 



17 - 




REF ID : A4148948 



Ho. 



19 



22 



25 



24 



25 

26 



27 



28 



Indicators 

184 * 260 




224 224 




4l6 * 
28 
TO 




Length 

M A. -VSL •' f*** IT* A. a *1 



215 


215 


161 




224 




71 


456 


342 




28 


370 


314 


314 


26 




267 




114 


4 QZ 



165 165 



236 




118 


554 


366 


366 



270 

29 



Cycle 



563 

-224 



415 



>372 



267 



-520 



119 



758 
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Ho. 

28 

cont °d. 



29 



Indicators 



:otal 



30 



31 



32 



33 



788 
001 * 
452 

pT' 5 ' 

fef-* 

156 ■ 



030 

030 

>52 

TBS 



S 



>11 * 
611 * 
177 

788nr 
001 * 
462 



■a 



46T 
463 * 
294 

“57 * 
2 



52 
2 ) 

156 

W 

001 

177 

T78 

178 
462 

w 

001 



I 



739 * 
2 
7 

001 * 

314 

315 * 
315 * 



293, 

21 



368 * 

JLg^- 

37^ r 



2W 
2 
32i 
326 
J14 
6?0 
001 

a 



054 

oj - 



4l8 4 18 



001 * 474 

166 166 

W'^“64o 

167 * 001 

6o4 604 

77T“*~6o5 

111 L 

785 * 619 



788 * 622 
001 * 622 
18 18 
ol9 * 64o 



019 * 
52S 



34 




452 


751 


156 




177 




462 




294 


1089 


29 




314 




53 


396 


4l8 




166 




6o4 


1188 


3 




18 




535 


556 


96 




130 




292 578 



Cycle 



-29 



610 

>177 

462 



-325 

314 



-473 



18 



. 657 

/ 

-130 



-19- 
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Message 

Ho. 


Indicators 


Length 

Partial Total 


Cycle 


34 


300 * 430 
210 210 
510 * e>46 
510 * 001 
278 278 
788"' fe ~2W 
001 * 279 

1 ? 

020 ^298 
(7 7) 


210 

278 

19 _ _507 


509 

-278 


35 ~ 


027 * 305 

362 * 001 
160 160 

r 


335 

16° 45J 


361 




HEM YORK 


SERIES 


- 


Message 

Ho. 


Indicators 


Length 

Partial Total 


Cycle 

■ ■ 1111 



1 



2 



3 



4 





171 
5 
566 
64 
630 



32 
156 
T# 
001 

417 
TOT 

418 
188 
60T 



171 

* 001 

64 

ir oF5 

^067 

^_15| 

* 223 



*“64o 
* 001 
188 
^TH9 



74 



83 151 



307 307 

171 



156 



417 



188 761 



713 

-74 



565 



-222 



417 
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Indicator’s 




8 



9 



10 



11 




— -428' r 


397 


243 

Wh? 


243 

CTO' 


671 * 


001 


JZ , 


17 




TOT 


001 * 


018 


5 6 


56 


057 * 


Tjf 3 ? 


( 2 


2) 



12 




Length 

Partial Total 



170 

35. 205 

242 

m 

329 329 



52 

131 




243 

1J 

-56, 



316 



564 

21 585 



142 

g3&_ -,J 5& 



Cycle 

-360 

279 



-508 

131 

670 

-17 

622 

-165 
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15 



16 



17 



Ho. 


Indicators 


Partial 


Total 


Cycle 

Qk 'ii,— r«a-T n . 


12 


220 * 585 
■ AMR 

_ ( 3 . 3 ) 


253 


255 




13 


47 5 * 641 

476 * 002 

256 236 
712 258 

( 2 2 ) 


256 • 


236 


47^ 




74 

128 . 



126 



255 

46 



272 



255 



-315 



326 



18 



19 



20 



21 



788 -V W 
001 * 462 
ITS , „ 1Z8 
179 * 640 
179 * 001 

7 7 


178 

7 


231 


-461 

178 


186 * 008 
( 2 2) 








188 * 010 
2^6 276 

C 2 2) 


276 


276 




284 284 

750 * 572 

C 2 2) 


284 


.=3* 

CO 

OJ 




752 • 57* 
_2« ?6_ 
78^ * 610 
001 * 610 

ofr^iio 
051 * 001 
68 68 
099 * 069 


36 

30 

68 


134 


-609 

30 



( 2 2 ) 
ldi n *"Wi 
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Message 

No. Indicators 


21 


101 * 


071 




128 


128 




229 "*’ 


199 




( 2 


? 


22 


““231 * 


201 






- 155 . 

134 



Length 

Partial Total Cycle 

128 128 

155 155 



NORFOLK SERIES 



Message 

No. Indicators 



Length 

PartialTotal 



Cycle 



1 



2 



3 



4 



5 



6 



518 * 001 
270 270 

78H"*”271 
001 * 271 
244 244 




317 
123122 
370 ^S4o 
370 * 001 
197 1< 

J2 -Si 

569*200 
219 219 

001 * 419 
_5£_32 







331 
279 
610 * 3B9 



si 



391 
176 176 
788^~5b7 
001 * 567 




270 




122 

197 520 



219 

J5S 

167 

107 

279 



271 

274 

279 



176 

73 



517 

-270 



369 



~4l8 



221 



-566 



-23 
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Message 
No. 

6 

cont G d, 



8 



10 



14 



Indicators 
0?4 * 640 



213 

L 1 

215 * 142 
163 163 

37b"*' 305 
2 

380” 

122. 



19 * 
2 



521 * 
192 



307 

21 



713 * 
713 * 



W 

192 



78b* 
001 * 
1.79 



0 * 
2 



1827 * 

2§L- 

565^ 
565 * 
223 

7§f 



W 

001 

__Z5. 
U76 
076 
179 
^55 
2 ) 



237 

383 

Mo 

001 

223 



22* 



L-T^T 
001 

197 

198 
ii 



*"Tkj 

* 372 

A2X 



200 

69 

269 

269 

210 



* 559 

jlL 



* 571 
„ 69 

* 001 
210 



479 

2 



15 



* 211 

21 



Length 



.gth 

Partial Total 




122 . 



388 



163 

139 

192 

75 

179, 



163 



139 



446 



383 



223 





001 * 
71 


224 

71 


71 


677 




072 * 


295 

2) . 






11 


oT % » 
2g— 

417 * 
417 * 
64 


297 

640 

001 

64 


343 

64 


407 


' 


48i"*~ 
C 2 


“065 

2) 






12 


48^7“ 
227 
710 * 

( 2 


'067 

227 

"29? 

2) 


227 


227 


13 


712 * 


“296^ 







127 



212 



69 

210 



* 



213 



Cycle 

73 



712 



-75 



564 



416 



-371 



268 
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He 3 sage 
Ho. 

15 



16 



Indicators 



481 * 




001 * 
120 
I2T^“ 
121 * 
6 |< 

760 * 
28 

788 “”*" 
001 * 

sil*** 



029 

029 

93 



122 



Length 

Partial Total 



195 195 

110 

120 

639 

28 




Prole 



-519 



120 

759 



-28 



Remarks on Calculations 

It Is to be noted that these calculations exhibit a remarkable 
consistency, and corroborate the calculated lengths of the two 
keys, 787 and 659, respectively. By the consistency of the calcul- 
ations we mean that it would be utterly Impossible to have the 
calculated slip between messages equal for both keys in every case 
as a result of coincidence; for, unless the assumed lengths of the 
two keys be correct, the slip would be unequal and inconsistent 
In many places. The fact that they are equal means that the 
encipherer was consistent in slipping both tapes an equal distance 
every time. The idea behind an equal slip Is not clear, for it 
entirely defeats its own purpose, which is to prevent the enemy 
from determining the lengths of the keys. Had the encipherer slipped 
them unequal distances in every case, being careful, of course, 
to slip the short tape further than the long, no such consistency 
would have been possible to uncover. But, in this case, the pos~ 
sibility of overlapping .messages, would be greatly Increased, as 
will be shown subsequently. 

As mentioned above, there are several discrepancies, due to 
errors on the part of the encipherer. That they are errors, and 
not intentional operations intended to deceive the enemy Is shown 
by their nature. For example, the slip between Washington 68 and 
69 is 2 * 12. Evidently the encipherer meant to have Washington 
69 begin at loci intervals away from where Washington 68 ended, 
and probably misread the number 249 on the short tape, making it 
259. This becomes the same as though he had slipped the long 
tape 2 letters and the short one 12. In the Hew York messages 
another error of 10 is Involved between messages 4 and 5- Had 
this error not occurred there woul d have been afforded about twice 
as 1 many po ss i blePpointlT of attack~as~vere actually the case, as 
will be sh^n~jate r 
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Excellent corroboration for the determined lengths of keys 
is afforded by finding the total numbers of letters in all mes- 
sages emanating from each station, adding the total amount of slip 
and then calculating as if only one message were concerned. The 
final result should coincide with the result obtained from cal- 
culations for the individual messages. Thus; 



(1) Washington Series 



Initial loci » 

Total number of letters enciphered . 

Total slip ........ 

Sum 26092 



and 40 
Final loci 



short 



) 



(2) Hoboken Series 

Initial loci . . . . 

Total number of letters enciphered 
Total slip 
Sum ...... 



ecu 
v 6 U a 



OOvOvtiOO 



« «. O a » 



Minus 17 revs, of long key) 
and 21 " . " short M . ) 
Final loci ..... ...... «..«.*< 



(3) Hew York Series • 

Initial loci \ 

Total number, of letters enciphered . . , 

Total slip' 

Sum 

Minus 9 revs, of long key) 

and 10 " n short * J * * 

Final loci 



(4) Norfolk Series 

Initial loci ...................... 

Total number of letters enciphered 

Total slip 

Sum 

Minus B revs, of long key) , 

and 9 ” " short ” )- 

Final loci - 



126 


* 001 


25834 


25834 


132 


132 


2609 F 


^^259o?> 


-25971 


-*25560 


121 


* 426 


322 


1 

* 001 


13503 


13503 


76 


76 


13901 


13580 


-12379 -13»19 


522 


* 161 


714 


* 001 


6914 


6914 


7685 — T962 


-7083 


_ -6390 


602 


* 572 


518 


* 001 


5841 


5841 


64^ 


31 

5873 


-6296 


-5751 


094 


* 122 
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In each case it will be noted that the final loci coincide 
with those given by the individual calculations, in perfect accord 
with the requirements based upon keys. 787 and 639 letters in 
length. 



The purpose of all these calculations was to find such cycles 
as would form the basis of an attack. A table was made, therefore, 
showing all the cycles, both plus and minus. Involved in the series 
of messages (see Table 1) . 

The most favorable relation of cycles for an attack being 
three sequent cycles {for definition see page 2 of Addendum 1), 
an examination of this table was made with a view to finding three 
sequent cycles. These were found, showing first in Table 1 In 
cycles 415* 416, and 417* messages Hoboken 22, Norfolk 11, and 
New York 4, respectively. 



By referring to the calculations on pages 6 - 25 * it will be 
seen that the three sequent cycles begin in reality with Hoboken 
19* latent cycle 711* Norfolk 9* latent cycle 712; and New York 1* 
latent cycle 713. They end with Hoboken 24. latent cycle 415; 
Norfolk 13, latent cycle 4l6; and New York '4, latent cycle 4lf. 

The extent of the three sequent cycles is Indicated in the cal- 
culations for these messages by the brackets. 

Had no errors been made In encipherment, these three sets 
of messages would have proceeded along in three sequent cycles 
to the following points? Hoboken 29* latent cycle -29; Norfolk 16, 
to Its completion in latent cycle -28; New York 10, latent cycle 
(theoretical or what It should have been) - 27 . The error referred 
to on page 25 made between New York 4 and 5 therefore cuts the 
numberoi^^ polnt1a"’of atteekTln 'half .' 

c. The messages Involved were immediately transcribed 
in the usual manner In the form of three sequent cycles. There 
were two excellent points of attack In these messages when arranged 
in this form. They were excellent because two messages began In 
one case at exactly the same point; In the other case, very near 
the same point. One of these cases is shown below. (The initial 
points of all messages shown hereinafter will be designated by a 
vertical double bar surmounted by an asterisk.) 



Upper key loci 3.82 186 

Lower key loci 256 260 

NEW YORK 2 ... 6XTSQWQZKW CMC PW IBY3GD3A6 JM . . . Cycle -74 



Upper key loci 
Lower key loci 
NORFOLK 10 

Upper key loci 
Lower key loci 
HOBOKEN 20 



*■ 

if 



182 186 
257 261 

SXH7GMERHP3QSNI3MCZVCTRV0U 



& 

1 1 186 
262 

II 3CTFJIXXI353F4PKQ5UDYEQ 



Cycle -75 
Cycle -76 
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TABLE 1 



Distribution of Cycles 



Plus 

( 0 - 100 ) 



Minus 

lo^ool 



1 {Washington 68) 
8 {Washington 39) 
15 {Washington 13) 
18 {Hoboken 32) 

25 {Hoboken 5) 

30 {Hew York 20) 

55 {Washington 49) 
62 {Washington 23) 

72 {Hoboken 16) 

73 {Norfolk 6) 




I Hew York 9) 
Washington 3) 
Norfolk 16) 
Hoboken 28) 
Washington 29) 
Washington 58) 

I New York l) 
Horfolk 9) 
Hoboken 19) 
Washington 24) 
Washington 5l) 



Plus 



102 (Washington 58 ) 
109 (Washington 27 ) 

119 (Hoboken 2?) 

120 (Norfolk 16) 

131 (New York 8) 

149 (Washington 66 ) 
156 (Washington 37) 
163 (Washington 10 ) 
173 (Hoboken 2) 



Minus 
(101 ° 2 ' 00 ) 

-123 (Hoboken 7) 

-130 (Hoboken 33) 
-133 (Washington 14) 
-140 (Washington 4l) 
“137 (Washington 70) 
-165 (New York 11) 
-171 (Washington 6 ) 
-177 (Hoboken 29 ) 
“178 (New York it) 
-187 (Washington 31 ) 
-194 (Washington 60 ) 



Plus 

(aoi-300) 

203 (Washington 47) 
210 (Washington 20) 

220 (Washington 14) 

221 (Norfolk 4) 

250 (Washington 56 ) 
257 (Washington 25) 

26 7 (Hoboken 24) 

268 (Norfolk 14 i 
279 ((New York 6) 

297 (Washington 64) 



Minus 

(201-300), 

-222 (New York 4) 
-224 (Hoboken 21) 
-234 (Washington 25 
-241 (Washington 52 
“270 (Norfolk l) 
-271 (Hoboken 10 ) 
-278 (Hoboken 34) 
“2ol (Washington 17 
-288 (Washington 44 
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Minus 

(3Qi4oo) 

-313 (New York 14) 
“315 (Washington 75) 
-325 (Hoboken 30 ) 
-328 (Washington 8 ) 
-335 (Washington 34) 
-342 (Washington 63 ) 
-360 (Hew York 5 ) 
-371 (Norfolk 13 ) 
-372 (Hoboken 24) 
-382 (Washington 25) 
-389 (Washington 55) 



Minus 

(401-500) 

-4l8 (Norfolk 3) 

-419 (Hoboken 13) 
-429 (Washington 20) 
-436 (Washington 46) 
-461 (New York 17) 
-466 (Hoboken 2) 

-473 (Hoboken 31 ) 
-4?4 (New York 13) 
-476 (Washington 10) 
-483 (Washington 37 
-490 (Washington 66) 



Plus 

(301 “400) 

304 (Washington 35) 
311 (Washington 8) 
314 (Hoboken 30) 

321 (Hoboken l) 

326 (New York 15 ) 
351 (Washington 45) 
358 (Washington lo) 
361 (Hoboken 35) 

368 (Hoboken 11 ) 

369 (Norfolk 2) 

398 (Washington 54) 



Plus 

(401-500 ) 

405 (Washington 25) 
"415 (Hoboken 22) 
,416 (Norfolk ll) 
k 4l7 (New York 4) 

445 (Washington 62 ) 
452 (Washington 32) 
462 (Washington 29) 
468 (Washington 7) 
482 (Washington 73) 
499 (Washington 43) 



Plus 



506 (Washington 16) 
509 (Hoboken 34) 

516 (Hoboken 9) 

517 (Norfolk l) 

546 (Washington 52) 
553 (Washington 25 ) 

563 (Hoboken 21) 

564 (Norfolk 10) 

593 (Washington 60 ) 



Plus 

(601-700) 

610 (Hoboken 29) 

616 (Washington 5) 
622 (New York 10) 
630 (Washington 70 ) 
647 (Washington 4l) 
657 (Hoboken 33) 

664 (Washington 7) 
670 (New York 9) 

6§4 (Washington 50 ) 



Minus 

(5.01^6001 

-508 (New York 8 ) 
-519 (Norfolk 16) 
-520 (Hoboken 26 ) 
“530 (Washington 27 ) 
-537 (Washington 57) 
-565 (New York 3 ) 
-566 (Norfolk 6 ) 

-567 (Hoboken 16 ) 
-577 (Washington 23 ) 
- 5 o 4 (Washington 49) 

Minus 

(601-700) 

-609 (New York 20) 
~6l4 (Washington 5 ) 
-624 (Washington 12) 
-631 (Washington 39( 
-638 (Washington 68) 
-654 (Washington 14) 
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Plus 




701 (Washington 24) 
712 (Norfolk 9) 

715 (Nev York l) 

741 (Washington 58 ) 
748 (Washington 29) 

758 (Hoboken 28) 

759 (Norfolk 16) 
764 (Washington 5) 



Minus 

( 701 - 800 ) 
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d. Since the messages begin with an address , it was only 
necessary to try out all the addresses that would be likely to 
occur in such messages. The modus operand! of these trials is 
given in Section 3 of this Addendxim. Suffice it here to say that 
the assumption of TRANSPORTATION 3 SERVICE, as the beginning of 
Hoboken 20, and ADJUTANT3GENERAL , as the beginning of Norfolk 10, 
yielded LEY3EQUIPMENT for New York 2 . There was no doubt now that 
the messages were broken. Subsequent work meant merely the con- 
tinuation of plain text in three cycles and the simultaneous re- 
construction of the keys. As an aid in this process, one of labor 
and patience, it was found necessary to decipher parts of many 
other messages in cycles as close as possible to these three. 

For example, the closest cycle to cycle -76 was cycle - 86 , repre- 
sented by Washington 25. As soon as the first fifteen letters of 
the short key had been reconstructed, viz, 260 to 275 # these in 
conjunction with longer key letters in loci 186 to 201 were applied 
-to Washington 25 at locus 186 in the longer key. They yielded as 
plain text 3 EACH 3 DAY 3 AS 3 THE . By applying the same steps to other 
messages, places in cycles - 93 , - 123 , - 130 ,. - 135 , - 1 ^ 1 , and also 
in -46, - 39 , - 29 , - 28 , - 17 , and -9 were deciphered, all with a 
view to expediting the work of rebuilding the keys, which was all 
that was necessary to complete solution since we had no interest 
in the messages, per se . The work was divided between two sections 
of operators, one section working forward from locus 186 of the 
long key, the other working backward until the work joined. Even 
with this number of cycles to work upon, the work went slowly 
because of errors in the encipherment. It was completed, however, 
in a comparatively short time, and the resultant keys were tested 
upon isolated fragments of new messages and found to be correct. 

X x 5.8 nc 0 s ss ry to add that the messages were broken within 
ten minutes after- one of those, very slight but ever-present errors 
rn~transcr 1 bing the letters' of the origlnafHBhree' sequent cycles 
had been uncovered , this- error Involved the Inadvertent omission, 
by one of our clerical staff, of a single letter from Norfolk 9 at 
a locus in advance of 186 , and resulted in baffling all efforts to 
solution for every hour subsequent to the finding and the tran- 
scription of the three sequent cycles. 

2. WHY KEY TAPES DIFFERING IN LENGTH BY MORE THAN ONE LETTER ARE 
CRYPTOGRAPHICALLY UNSAFE 

In the preliminary summary of this addendum it was stated 
that the present system of using this machine employing key tapes 
which differ in length by more than one letter Is much more un- 
safe than the original method employing key tapes which differ in 
length by only one letter. The reason for this is that the present 
system not only makes the production of overlaps very possible , 
but also imkes tKeir~^^duction,~c^er^certaln circumstances, a 
legitimate function of the machine" . In fact, the messages pre- 
sentecT ’’for' test "’made a ^hairbreadth escape from such a fate . 0 
The, point is well worth detailed explanation. 

The question which first arises in this connection is: Given 
the initial indicators for each of four stations, can the cycles 
through which all messages will pass be determined beforehand? 

The answer is in the affirmative. In fact, the cycles through 
which each series of messages will pass themselves go through 
definite cycles. Let us refer to the calculations for the Hoboken 
series and set down in the form of a list the successive plus 
cycles Involved: 
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HOBOKEN SERIES OF CYCLES 



321 

173 

25 

664 

516 

368 

220 



72 

711 

563 

415 

267 

119 

758 



610 
462 
314 
166 . 
18 



657 

509 

361 



The numbers in this list bear definite relations - to one 
another, relations which are absolutely determined by the displace- 
ment, or difference in the lengths of the two key tapes. In this 
case the difference between the lengths of the two key tapes is 
787 - 639 148. This means that if we make our calculations upon 

the basis of a stationary long key tape, the displacement of the 
short key tape will be 148 letters per revolution of the long key 
tape. This in turn means that the progression of cycles for each 
series of messages, as determined by the difference between the 
key indicators, will differ by the constant factor 148. Let us 
see if this is exemplified in the series of cycle numbers given 
above for the Hoboken messages. 



Series as calculated Series as observed 



Initial cycle 


321 




321 


2nd cycle of series 


148 

173 




173 


3rd cycle of series 


148 - 

25 




25 



If we continue to subtract 148, we would begin to introduce 
minus cycles, end since it is more advantageous to deal only with 
plus cycles, let us convert cycle 25 to the next higher multiple 
of this cycle number, by adding the length of the longer key tape 
to it. Thens 



^This is legitimate since all the calculations are based upon the 
revolutions of the long key tape. 



\ 
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25 




That Is, cycle 25 Is exactly the same as cycle 812. Now let 
ms deduct 148 , as before s 

812 

148 

Wf 

This agrees with the cycle number given by our list. We 
could have combined the two steps of adding 7 87 and then deducting 
148 in one step, by adding 639 , the length of the short key, to 
25. This would give the next cycle number. Thus, 



25 




Let us continue 





Series as calculated 


Series as observed 


1 . 


521 

148 


321 


2 . 


173 

148 


‘ 173 


3. 


*“25 

m 

148 


25 


4. 


T 6 ? 


664 




148 




5- 


515 


516 




148 


/ 


6 . 


m 

148 


368 


7« 


220 

148 


220 


8 . 


72 


72 




m 

148 




9. 


711 

148 


711 


10 . 


553 


563 




148 


415 » 


11 . 


415 




etc. 


etc. 



Thus, it is apparent that every cycle through xdilch each 
series of messages will pass can be predetermined, provided alway _3 
that no errors are made in the encipherment . * For, if the relative 
positions of the two key tapes be changed in the slightest degree 
at any time in the enciphering process, the natural or predetermined 
series of cycles will be modified. Such modifications actually 
occurred in the four series of test messages, entirely as a result 
of errors on the part of the encipherer. 

We give in the two lists which follow the series of cycles 
which actually resulted from the encipherment, together with the 
series which theoretically should have resulted. Each series has 
been arranged with reference to the others in a manner designed 
to show the production of sequent cycles. 
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THEORETICAL SERIES 



TABLE 2 



ACTUAL SERIES 



Wash* 

(X2OT01) 

125 

764 

616 

(468)1 

(459) 

311 

163 

15 

654 ' 
506 
358 
210 
62 
701 
553 
405 
257 
109 
758 
600 
452 

304 
156 
8 
647 
499 
351 
203 
55 
694 
546 
398 
250 
102 
741 
593 
445 
297 
149 p 

u 



Hoboken Norfolk Hew York 



321 

173 

25 

664 



5X6 


517 




368 


369 




220 


221 




72 


73 




711 


712 


713 


563 


564 


565 


415 


4l6 


(417 


267 


268 


(427 


119 


120 


279 


758 


759 


131 


610 


770 


462 




622 


314 




474 


166 




326 


18 




178 


657 




30 


509 






361 







Wash. 

(126^01 

125 

764 

616 

468 



320 


321 






172 


173 






24 


25 






663 


664 






515 


516 


517 




367 


368 


369 




219 


220 


221 




71 


72 


73 




710 


711 


712 


713 


562 


563 


564 


565 


414 


415 


4l6 


417 


266 


267 


268 


269 


118 


119 


120 


121 


757 


758 


759 


760 


609 


610 




612 


461 


462 




464 


313 


314 




316 


165 


1 66 




168 


17 


18 ' 




20 


656 


657 






508 


509 






360 


361 







212 

64 

703 

555 

407 

259 

111 

750 

602 

454 

306 

158 

10 

649 

501 



Norfolk 



Hew York 



■hsrror made In slipping the two key tapes between Washington 
7 and 8 . 

^Error made in slipping the two key tapes between Washington 
68 and 69 - 

^Error made In slipping the two key tapes between Hew York 4 and 5 
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A careful study of Table 2 discloses some very important facts. 

In the first place , the possibility of the production of over- 
laps is demonstrated very readily. Washington 1 began with the 
key indicators 126 * 001 , and Hoboken 1 began with the key in- 
dicators 522 * 001. Had Hoboken 1 begun with the long key at 521 
instead of 522 , the Hoboken series would have begun immediately 
to overlap the Washington series from the latter 9 s cycle 520 on 
to the end of the Hoboken messages. Again, Norfolk 1 began with 
the key indicators 518 * 001. Had Norfolk 1 begun with the long 
key at 517 instead of 518, or had Hoboken 1 begun with the long 
key at 525 instead of 522, the Hoboken and Norfolk series would 
have overlapped for the whole length of the Norfolk series. 

Again, New York began with key indicators- 714 * 001, and Norfolk 
1 began with key indicators 518 * 001. Had New York 1 begun with 
the long key at 71? instead of 714, or had Norfolk 1 begun with 
the long key at 519 instead of 518, the Norfolk and New York 
series would have overlapped.. 

The beginning points for each series were undoubtedly deter- 
mined by dividing the length of the long key by four (in order to 
divide the long tape into four nearly equal parts) and adding this 
number to the long key starting point for each series, consecutively. 
Thus, 787 * 4 st 196 . Given the long key starting point for Wash- 
ington 1 as 126, the long key starting point for Hoboken 1 was 
126 + 196 » 522; that for Norfolk 1 was 522 + 196=518; that for 
New York 1 was 518+196-714. 

It is impossible, of course, to divide a prime number into 
four equal integral parts. In the case under study the length of 
the long tape is 787- The number 196 is the nearest integral 
fourth part of 787 , it i3 true, but the division of the long tape 
into four parts is meant to be only approximate. The intention, 
as understood by us, is to allot to each station a length of the 
long key proportionate to its requirements as regards its day”s 
activity. With certain key lengths, the allotment on the basis 
of equal activity of four stations will result in the production 
of overlaps. Likewise, with other key lengths, the allotment on 
the basis of unequal activity will result in the production of 
overlaps. Examples will be given. 

Returning to this case, had the number 195 been taken as the 
amount to be added consecutively, instead of 196, here are the 
starting points that would have resulted for the four series: 



Washington ' Hoboken Norfolk New York 

(126 .* 001 (321 * 001 ) (516 3 001 ) (711 * 001 ) 



Had this been the case a four-fold overlap would have been 
produced. Note the sequences of cycle numbers. 
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TABLE 3 



Washington 


Hoboken 


Norfolk 


New Yc 


(126 & 001) 


(321 * 001 ) 


(516 * 001 ) 


(711 * C 


125 








764 








6l6 








468 








320 


320 






172 


172 






24 


24 






663 


663 






515 


513 


515 




567 


367 


367 




219 


219 


219 




71 


71 


71 




710 


710 


710 


710 


562 


562 


562 


562 


etc. 


etc. 


etc. 


etc . 



The cycle numbers would have coincided for the four series 
from cycle 710 onwards, and the four series of messages would have 
overlapped one another. 



That this is not stretching the possibilities of the situation, 
consider the results of the adoption of 78 7 and 669 as the two 
lengths. These numbers do not possess a common factor and are not 
multiples of one another, so that their choice as key lengths is 
legitimate and likely. The displacement 13,787 - 669 118° The 

allotment we will assume to be equal; the starting point for 
Washington 1, as 126 * 001. The starting points for the other 
series and the cycles are as follows; 



TABLE 4 



Washingt on 1 

nmoir 



Hoboken 1 



Norfolk 1 

iw^ool) 



New York 1 





Cycles 




Cycles 


1 


125 


1 


321 


2 


7 


2 


203 


3 


676 


3 


85 


4 


558 


4 


754 


5 


440 


5 


636 


6 


322 


6 


518 


7 


204 


•7 


400 


8 


86 


8 


282 


9 


755 


9 


164 


10 


637 


10 


46 


11 


519 


11 


715 


12 


401 


12 


597 


13 


283 


13 


479 


14 


165 


14 


361 


15 


47 


15 


243 


16 


716 


16 


125 





Cycles 




Cycles 


1 


517 


1 


713 


2 


399 


2 


595 


3 


281 


3 


477 


4 


163 


4 


359 


5 


45 


5 


24l 


6 


714 - 


6 


123 


7 


596 


7 


5 


8 


478 


8 


674 


9 


360 


9 


556 


10 


242 


10 


438 


ll 


124 


11 


320 


12 


6 


12 


202 


13 


675 


13 


84 


14 


557 


14 


753 


15 


439 


15 


635 


16 


321 


16 


517 



etc. 



etc. 



etc. 



etc. 
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Pilots now that a four-fold overlap would .be the legitimate 
result of the choice of these lengths. This case Is interesting 
also because it would produce four sequent cycles in addition to 
the overlaps. In other words /had the length, of the short key in 
the series of test messages been 30 letters more than It tos, not 
'only would there have been produced four sequent cycles but also 
a four -fold overlap® 

It my be desirable to give further instances. Let us assume 
two key lengths 8ll and 752 * two legitimate lengths. On the basis 
of equal activity, the" allotment would be 8ll -s- 4 =202' letters of 
the long tape per station. Suppose we start with the indicators 
126 * 001 for the first message of the Washington series. The 
initial points for the other series will be as shown below; 



Washington 1 Hoboken 1 Norfolk 1 Nei? York 1 
(126 * 001) (228 * 001) (530 * 001) (722 * 001) 

Now let us calculate the various cycles and tabulate them. 
The displacement is 8ll - 753 = 58. 



TABLE 5 

Washington Hoboken Norfolk New York 

(126 * 001) (228 * 001) (530 * 001) (732 * 001) 



1 


125 


1 


327 


2 


67 


2 


269 


3 


9 


3 


211 


4 


762 


4 


153 


5 


704 


5 


95 


6 


646 


6 


37 


7 


588 


7 


790 


8 


530 


8 


732 


9 


472 


9 


6?4 


10 


414 


10 


616 


11 


356 


11 


558 


12 


298 


12 


' 500 


13 


240 


13 


442 


14 


182 . 


14 


334 


15 


124 


15 


326 


16 


66 


16 


268 


17 


8 


17 


210 


18 


761 


18 


152 


19 


703 


19 


94 


20 


645 


20 


36 


21 


587 


21 


789 


— 22 


529 


*4» 22 


731 


23 


471 


23 


§73 


24 


413 


24 


615 


etc . 


etc. , 



1 529 -+> 1 731 

2 4?1 2 673 

2 413 3 615 

4 355 4 557 

5 297 etc. 

6 239 
etc. 
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Hot© that two overlaps would be produced j the first cycle 
of the Norfolk series would overlap the. 22nd cycle of the Washing- 
ton series; the first cycle of the Wet? York series would overlap 
ishe 22nd cycle of the Hobokea series. 

Let us sow take a case of differential allotment s assuming 
tfo&t the relative activities ©f four stations are in the proportion 
©f 4s2si;l. These proportions approximate the actual proportions 
ia the serie© of test messages. We will adopt as key lengths 751 
and 651- The displacement is 100 per revolution of the long tape. 
Allotment oa the basis of the ratios 4 s2;1j 3L gives as the initial 
joints for tho four stations the following indicators s 



TABLE 6 



W® shihgfcosa i 


Hoboken 1 


Norfolk 1 


New York 1 


(aoo * eoi) 


(472 * GOl) 


(658 * 001) 


(751 * 001) 


Cycles 


Cycles 


Cycles 




Cycles 


1 99 


1 471 


1 657 


— ^ 1 


750 


—*2 750 


2 371 


2 557 


2 


650 


3 650 


3 271 


3 550 


5 


550 


4 550 


4 171 


4 450 


4 


450 


5 450 


5 71 


5 550 


5 


550 


6 350 


6 722 


6 250 


6 


250 


etc. 


etc. 


etc. 


etc. 



The New York series of messages overlap the Washington series 
immediately after the latter has entered its second revolution of 
the long tape. 

Here is another instance. Let the allotment.be in the propor- 
tion 1^:1 si : , and let the keys be 769 and 598. The initial points 
would be as follows! 
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TABLE 7 



Washington 1 


Hoboken 1 


Norfolk 1 


Hew Yor 


(100 * 001 ) 


(355 * 001 ) 


(525 * 001 ) 


(695 * 0 


Cycles 


. ' 


Cycles 


Cycles 


Cycles 


1 


99 




354 


•**1 524 


694 


2 


697 


2 


183 


2 353 


2 523 


3 


526^ 


3 


12 


3 182 


3 352 


4 


355 


4 


610 


4 11 


4 181 


5 


184 


5 


439 


5 609 


etc. 


6 


13 


6 


268 


6 438 




7 


611 


7 


97 


7 267 




8 


440 


8 


695 


8 96 




9 


269 


*4*"> 9 


524 


41* 9 ' 694 




10 


98 


10 


353 


i- etc. 




11 


696 


ll 


182 






12 


52£ 


12 


11 






'•*■>13 


354 


13 


609 






14 


183 


14 


438 






15 


12 


15 


267 


1 




16 


610 


16 


96 


, 




17 


439 


~H*i7 


694 






18 


268 


etc. 


\ 




IS 


97 










20 


695 










4*21 


524 






' x 




22 


353 . 




. 






23 


182 




/ 






24 


11 










25 


609 










26 


438 










2? 


267 










28 


96 










-W*30 


694 










31 


523 










32 


352 










33 


181 











Here the Hoboken series would make a single overlap with the 
Washington series beginning with cycle 354; & three -fold overlap 
would be produced with the Norfolk aeries when cycle 524 would be 
reached; and when cycle 694 would be reached the Hew York series 
would join and make a four-fold overlap. 

Another case where overlaps would be produced legitimately 
in an equal allotment is as follows ; Let us assume two keys 917 
and 723 . Equal allotments of the long tape would give the follow ~ 
ing initial points; 
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TABLE 8 



Washington 1 
(100 * 001 ) 

Cycles 



Hoboken 1 
(329 * 001 ) 

Cycles 



Norfolk 1 

(558 * 001 ) 

Cycles 



Hew York 1 

(787 * 001) 

Cycles 




1 786 
etc 



Here we would have a three -fold overlap; the Hoboken and 
Washington series would first overlap, then the Norfolk series 
would join in. 

Take the case of the lengths of tapes Involved in these test 
messages. Let us assume an allotment on the basis of The 

beginning points and the cycles for the four stations are as follows 
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TABLE 9 



Washington 1 

(126 * 001 ) 



Hoboken 1 
(519 * 001) 



Norfolk 1 
(650 * 001) 



New York 1 
(781 * 001) 



Cycles 



Cycles 



Cycles Cycles 




Such cases are not at all merely theoretical instances , but 
would be bound to happen. The solution of a case involving a single 
overlap, even for a short distance is very easy. To demonstrate, 
let us assume that the New York series of messages had begun with 
the key indicators 713 * 001 Instead of 715 * 001 In Norfolk 9. A 
brief trial of possible beginnings for New York 1 would have 
resulted in yielding the excellent plain text shown below, when the 
address TRANSP0RTATI0H3SERVICE had been assumed. 



I 
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Long key loci 713' 723'-" 733' 

Short key loci 001 0 X 0 020 

• New York 1 Cipher NTEXDRMUC IZOUH6M4 YMFP5 . . . Cycle 712 

Assumed plain text TRAHSP0RTATI0N3SEKVICE . . . 

Long key loci 713 723r .733 

Short key loci. 001:. 010 . 020 

Norfolk 9 Cipher VBUHRI4Z5DZQK76INZIW7N ..0 Cycle 712 

Resultant plain 2 ASSIGMHT 3 TO 35 SCHOQL 
Text 

As has already been stated the occurrence of such overlaps is 
not due to carelessness or errors, but is a legitimate function of 
the method, viz, the introduction of a difference of more than 1 
between successive revolutions. The mathematical conditions under 
which these legitimate overlaps will be produced may be stated as 
follows ; 

When, during the enciphering process in two series of messages, 
the displacement becomes equal to the initial difference between 
the cycle numbers of the starting points, the two series of mes- 
sages will begin to overlap. For example, given two series of 
messages, A and B, with the starting points 375 * 001 and 765 * 001, 
respectively, (keys 787 and 639 in length), after 5112 letters have 
been enciphered in Series A, an overlap will be produced with 
series B. Thus: 

Series A Series B 

373 * 001 765 * 001 

5112 5112 



Deduct (787 x 6) and (639 x 8) 



This result could have been predicted from the rule given 
above. The calculations which would show the same result theoretic- 
ally are as follows: 

Cycle difference of initial points 784 - 374 = 390 

Displacement after 8 revolutions of 
the short tape and 6 revolutions 
of the long tape, that is, 

(639 x 8) - (787 x6) • 5112 -4722 = 390 

The calculations for the case in which the two key lengths 
were 787 and 669 are as. follows : 

Hoboken 1 322 * 001 Cycle 321 787 x 13 = 10221 

Wash. 1 126 * 001 Cycle 125 869 x 15-10025 

19o Displacement -19o 

In other words, given the starting points of the Hoboken and 
Washington series as 222 * 001 and 126 * 001, respectively, after 
15 revolutions of the short tape i(and 13 of the long at the same 
time), the Hoboken series would begin to overlap the Washington 
series. 

' Another important fact disclosed by a study of Table 2, giving 
the series of cycles produced in the test messages, is that the 
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cycles produced as the two key tapes progress go through definite 
cycles themselves. It is clear that from any given starting points, 
if the encipherment proceeds without Interruption or error until 
the total possible number of different pairs of key letters has 
been exhausted, the two key tapes would go through every one of the 
possible cycles, in this case 787 • It would be possible in such 
a case to select any number of sequent cycles for analysis, since 
every cycle would be included in the series of cycles used by the 
station. But since the method of U3ing the tapes by allotment is 
Intended to keep each station within certain limits as regards 
the number of cycles at its disposal, it follows that this normal 
relation does not hold, and the series of cycles used by one of 
four stations may or may not include two or more sequent cycles. 
Since the members of the chain of cycles differ by a constant 
interval (governed by the displacement), it Is possible to select 
messages the cycles for which are separated by the "smallest 
possible interval." For example, note the Washington list In 
Table 2. In this series of messages the smallest possible Interval 
between any two cycles is 7s that is, the nearest cycle to cycle 
125 is cycle 118; the nearest cycle to 764 Is 757 , or 7 removed, 
etc. The smallest possible Interval is a function of two factors: 
(l) the displacement and ( 2 ) the allotment. The smallest possible 
interval is really determined by the least possible displacement 
within the limits set by the allotment as the encipherment con- 
tinues. This, w© may explain as follows: 

Given 001 * 001 as the starting point, after 7&7 letters 
have been enciphered, the long key Is at 001, the short key at 
/J001+ 787 ) “ 65^7 « 149. The displacement of the short key is 
therefore 149 - 001-148. After 787 More letters have been en- 
ciphered, the long tape Is again at 001, the short tape at 
70-49 ^ 787 ) - 63 ^/ = 297. The displacement of the short tape Is 
therefore 297 - 001-296. Continuing this calculation, let us 
find the relative positions of the two tapes at the end of a few 
more revolutions. 



Displacements 

1 

Relative positions at end of 2nd rev. of long tape 001 5 297 296 

n n « « " n « n n 44^ 444 

" nun 11 ^th " " " ", 001 * 593 592 

" " • " " " 5th " " " " 001 * 'fix* ,640 = 101 

/ 

Since the short key Is only 639 letters in length, then locus 
74l is the same as locus 102. Therefore the displacement after 
the 5th revolution of the long tape Is 101 letters. Mow the 
successive displacements as determined above may be found by 
adding 148 successively and making proper deduction for the length 
of the short key. Let us /See what the displacement is after a 
few more revolutions. 
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Revolutions 
of Long Key 

1 
2 

3 

4 

1 . 

I 

9 

10 

II 
12 
15. 

calculation, note the following: 

659 
16 
583T 
659 
1022 ? 

Displacement s 10251 - 10224 

That is, after 15 revolutions of the long key tape, during 
which the short tape has made 16 revolutions, the displacement of 
the short tape is 7 . We may say, therefore, that with the two key 
lengths given, viz, 787 and 639 , after approximately 1025 0 letters 
have been enciphered, the cycle in which the message will be pro- 
ceeding at the time will be 7 removed from the initial dycle. If 
the amount of traffic for any station reaches or exceeds this num- 
ber of letters. It becomes possible to select messages, all emanating 
from- the same station, the cycles for which are only 7 Intervals 
apart. This is actually the case in the series of test messages. 

If only one station were concerned, when the long tape would have 
made 639 complete revolutions, the short tape would have made 787 
complete revolutions, the displacement would be 0, and every pos- 
sible cycle would have been represented. 

It Is clear, therefore, that by alloting a definite number of 
cycles to each station, the smallest possible interval between any 
of its cycles is a function of the least possible displacement and 
the number of cycles which has been allotted to the station. With 
certain lengths the least possible displacement may become unitj 
within the limits of the allotment of a station, and thus sequent 
cycles for messages from the same station become possible as a 
legitimate function of the system. For example, the two key 
lengths 811 and 753 yield the list of cycles given in Table 5. 

The list of the Washington series shows that the smallest possible 
Interval is 1; for example, ve have cycle 125 at the start-, and 
cycle 124 as the fifteenth cycle in the series. The following 
list gives the series of displacements for these two key lenths. 



As a check on this 

787 

13 

2351 

787 

10231 



Displacement 

148 

296 

444 

592 

101 

249 

397 

545 

54 

202 

350 

498 

7 
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Revolutions 

of Long gane Displacement 



1 


58 


2 


116 


3 


174 


4 


232 


5 


290 


6 


3^8 


7 


406 


a 


464 


9 


522 


10 


580 


ii 


638 


12 


696 


13 


754 



That is* after 13 revolutions of the long tape the net dis- 
placement would be 1* and the cycle upon which the message would 
then be about to enter would be ’directly sequent with the initial 
cycle. After 26 revolutions of the long tape, there would be 
three sequent cycles* and the series of messages would then run 
along in three sequent cycles. 

It would be very easy to find a great many cases where the 
least possible displacement within the allotment limits is 2* 3* 4, 
or 5 intervals. In another section of this Addendum, we shall show 
how the possession of three sequent cycles is no longer absolutely 
essential before a solution can be achieved. Cases where the 
cycles are separated by the same interval greater than 1 or by 
different intervals (within certain limits) are susceptible of 
solution. 

3. METHODS FOR EXPEDITING THE TRIALS NECESSARY TO MAKE THE 
INITIAL BREAK IN THE DECIPHERMENT 

It is quite true that there are difficulties In making the 
first break, but these are by no means so great as would seem. 

It is necessary* before the decipherer can make -the first 
break, that he find the correct plain text at the correct loci for 
two cycles. He may have the correct' plain text for both cycles, 
but unless he applies It at they correct loci, all his efforts are 
of no avail. 

No^ In the original explanation It was shown how the correct- 
ness of the assumptions of plain text for two cycles, hereafter 
to be designated as the "Experimental Cycles," was tested on the 
third, hereafter to be designated as the "Confirmative Cycle.” 

This step necessitates the reconstruction of the long and short . 
keys for the points where the plain text is assumed in the two 
experimental cycles and testing the reconstructed keys upon the 
third or confirmative cycle, at the proper loci. This process Is 
very laborious and time-consuming, and where a great number of ; 
trials must be made, the recovery of the individual key letters 
by the process Illustrated In Plate 1, Fig. 7 of the original 
paper is out of the question, unless a very large force of opera- 
tors is at hand. 

However, it is possible to reduce the process to such simple 
terms that a single operator can make as many as two thousand 
trials in three to four hours. 
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The easiest way to explain the process is to discuss the 
actual example afforded by the following three sequent cycles, 
with messages beginning at the points indicated by the stars and 
bars, as was the case with Norfolk 10 and Hoboken 20. 



Upper key loci 
Lower key loci 
MEW YORK 2 

Upper key loci 
Lower key loci 
NORFOLK 10 

Upper key loci 
Lower key loci 
HOBOKEN 20 



186 196 

260 270 

... 6XTSQWQZKWCMCPWIDY3GD2A ... 

J 186 196 

261 271 

. . . I ISXH7GMERHP3QSNI3MCZVCTR . . . 

«• 

18 6 196 

262 272 

3CTFJIXXLK3F4PKQ5LD ... 



Cycle -7^ 
Cycle -75 
Cycle -76 



In this case it is necessary to assume beginnings for Norfolk 
10 and Hoboken 20, the experimental cycles, then test the assump- 
tions upon New York 2, the confirmative cycle. 

This testing may be done through the agency of Reconstructed 
keys, but it is patent that the keys so reconstructed are of value 
not in themselves, but only insofar as they do or do not yield 
good plain text for New York 2. We may, therefore, omit the step 
of reconstructing the keys, if we can test whatever asspnptions 
are made with respect to the experimental cycles directIy~on the 
confirmative cycle wi thouttheir Intermediacy, and thus save a 
great" deaY~of^ ^ time' and labor. ~ : ‘' r 



In order to understand the method. It will be necessary to 
consider the relations existing between certain sets of letters In 
the long and short keys In three sequent cycles. In the subsequent 
discussion, for the sake of clearness, the long and the short keys 
will be designated as the upper and the lower keys, respectively. 



A R Q N V . . , . 
Z X T P 0 R N o . 
I N G 3 T . „ . . 
H 6 X V P . . . . 



A R Q, N V 0 . . . 
X T P 0 R N . . . 
COMMA. . * . 
T Z X 4 Q . . c , 

A R Q 1 V . , ... 
T P 0 R N . 0 . . 
A D J U T , „ . . 
T Y 3 E 2 /. . . . 



Note that In Cycle 1 the plain text letter G is enciphered 
by the conjunction 'of the pair of key letters Q and Tj in Cycle 3, 
the plain text letter D enciphered by the conjunction of the pair 
of key letters R and P. Now these two pairs of letters, viz, Q s 
T, and R, P form a single set of letters which encipher two adjacent 
letters of the plain text In Cycle 2, in criss-cross fashion. That 
is, in the second cycle, Q of the upper key in the first cycle 
unites with P of the lower key in third cycle ; while T of the lower 
key in the first cycle unites with R of the upper key in the third 
cycle. Now the nature of the enciphering square, being completely 
symmetrical, is that no matter In what manner the letters of a 
set are united, the final or resultant letter is the same. For 



CYCLE 1 



Upper key 
Lower key 
Plain text 
Cipher 



CYCLE 2 



CYCLE 3 



Upper key 
Lower key 
Plain text. 
Cipher 

Upper key 
Lower key 
Plain text 
Cipher 



«• 
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example, taking the four letters Q, T, R, and P, no matter how v 

these letters come Into juxtaposition or in what order they are 
taken, the result of the summation of the four of them will be "6". 
The result of these relations is that the second or middle cycle 
In any three sequent cycles represents a series of sets of letters 
which form a symmetrical or balanced system with certain sets of 
letters in the upper and lower cycles. It Is analogous to the 
manner in which the two extremes in a proportion balance the two 
means. Such a set of letters will be designated hereafter as a 
"Balanced Set,” This balanced relation holds true not only for 
the letfcersj it holds also for the correct plain text letters 
with their respective cipher letters, because In every case the 
plain text with Its cipher letter is balanced or is symmetrical ^ 
with the two key letters involved. For example, the resultant of 
Q and T, via, U, coincides with the resultant of G and X, viz, U. 
Therefore, the balanced or symmetrical relation existing between 
the key letters in the three sequent cycles, as pointed out above, 
exists also between the plain text and respective cipher letters 
Involved. 

Just as in the case of proportion (in mathematics) one can 
determine the unknown mean or the unknown extreme from the given 
relations between the three known quantities, so one can determine 
from these relations, without the intermediacy of the key letters, 
the unknown plaintext letter In the fourth set, assuming the 
correct plain-text letters In the proper loci In the other three 
sets. When the correct assumptions are made for the experimental 
cycles, therefore, the correct plain text must result In the con- 
firmative cycle; the key letters can be reconstructed afterwards. 

Let us apply the obvious steps to the example above, giving 
only the cipher letters first; 

X V P 
X 4 Q 
5 S 2 

In the following explanation we shall indicate by the Greek 
letter Sigma (£) that the summation of the series of letters is 
to be taken. Thus; 



CYCLE 1 


C onf I v emCycle 


H 6 


CYCLE 2 


Experimental Cycle 


T 2 


CYCLE 3 


Experimental Cycle ■ 


T Y 





The resultant series of letters B Q K 4 ... , which w© have 
termed the BASE, forms the framework upon which the assumptions 
are made and the results noted. Let us assume that the message 
in one of the experimental cycles, viz. Cycle 2 begins COMMANDING, 
and then let us try all other possible beginnings for the other 
experimental cycle, viz. Cycle 5, in conjunction with it. First, 
it is necessary to "add" the letters of COMMANDING to the base, 
in the manner shown below, which gives the resultant of the first 
assumption, or, as we shall term It merely, the FIRST RESULTANT . 



K 
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Base 

Assumed plain text 
for one experimental 
cycle 2 



Q 

M 




K 

M 



4 

A 



FIRST RE3ULTANT 



(B 

(C 

(0 

K 




(K 




(4 

CM 

(A 

Q 



We are ready now to try in conjunction with the first resultant 
all possible beginnings for the other experimental cycle (Cycle 3)- 
Let us assume that this message also begins with COMMANDING and 
find the second resultant. If the plain text assumed for both 
experimental cycles is correct, and in the correct loci, then the 
second resultant must yield intelligible plain text. 



FIRST RESULTANT 




K 


W 


K 


Q 


Assumed plain text for 
other experimental cycle 3 




0 , 


M 


__M , 










SECOND RESULTANT 




E 


J 


W 


J 


This gives E J W J as the second resultant, or the plain text of 
the confirmative cycle (Cycle 1), and we realize at once that one 
or both of our assumptions for the experimental cycles are incor- 
rect. Let us retain COMMANDING as the beginning of Cycle 2, and 
assume THE3 as the plain-text beginning of Cycle 3» instead of 
COMMANDING. The results are as follows: 


FIRST RESULTANT 




K 


w 

/ 


K 


Q 


Assumed plain text 
other experimental 


for 

cycle 


\ T 


H 


E 


2 










SECOND RESULTANT 




5 


U 


C 


V 


\ 

This, too, is clearly incorrect, 
of ADJUTANT: 


Thus we 


proceed until 


the trial 


FIRST RESULTANT 




K 


W 


K 


0. 


Assumed plain text 
other experimental 


for 

cycle 


] 


D 


J 


_U 










SECOND RESULTANT 




N 


G 


5 


T 



Here is a good possibility, and we proceed at once to add to it. 

Now all these trials can be made very rapidly by the use of 
certain sliding alphabets. These are prepared by cutting apart 
the columns of the cipher square, accompanying each alphabet by 
the straight alphabet including the "functions," and arranging 
the letters as shown below, where only the first five and last 
five pairs of the A, B, and C alphabets are given, (Fig. 20) . 
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Taking the sliding alphabets indicated by the first resultant, 
viz s K, W, K, and Q alphabets, we slide them in such a manner as 
to align the letters of the assumed plain text, using the upper 
(normal sequence) member of each pair of letters for this, where- 
upon the resultant plain text for Cycle 1 (the second resultant, 
or the text of the confirmative cycle) appears on a line made up 
of the other (mixed sequence) member of each set of letters com- 
posing the pairs. Thus, -the trial of the first four letters, 

ADJU, of the assumed plain-text beginning for the one message, would 
place the sliding alphabets in the position shown in Pig. 21, 
wherein the four letters of the resultant plain text for the other 
message is immediately apparent; N G 3 T. Thus, by sliding the 
alphabets, all the possible beginnings for Cycle 5 are tested with 
the assumed beginning, COMMANDING, for Cycle 2. If no good results 
are obtained, then one assumes some other beginning for Cycle 2 
and goes through the same steps again. If no errors have been 
made in calculations, when the correct beginnings have been assumed 
in the correct loci of the experimental cycles, the correct plain 
text must appear in the confirmative cycle. 

While it may not be apparent, it is nevertheless true that 
this process viewed in its proper light reduces the three sequent ' 
cycles to^ th^"^rms of an '‘'overlap . ' ~^he~n~an overlap occurs, it 
is necessary to assume the correct plain text in the correct locus 
for one message, whereupon the correct plain text for the other 
message appears. In this method, it is necessary to assume the 
correct plain text in two loci. 



Let us go through the solution of the test messages,. a3 it 
actually was achieved. The three messages Involved are New York 
2, Norfolk 10, and Hoboken 20, of which the last two mentioned 
are the experimental cycles j the first, the confirmative cycle. 
This is one of the two excellent points of attack referred to on 
page 27« The steps are summarized below; 



Upper key loci 
Lower key loci 
NEW YORK 2 

Upper key loci 
Lower key loci 
NORFOLK 10 

Upper key loci 
Lower key loci 
HOBOKEN 20 



186 196 

260 270 

. . . 6XTSQWQZKWCMCFWIDY3GD3A 

1 86 196 

261 271 

. . . SXH7GMERHP5QSNIJMCZVCTR 
* 

1 186 196 

262 272 

'! 3CTFJIXXLK3F4PKQ5LD 



Cycle - 7 ^ (Confirmative) 



Cycle -75 (Experimental) 



Cycle -76 (Experimental)^ 



WQZKWCMC . o . 
GMIRHPJQ . . o 
MERHP3QS . . . 
3CTFJIXX , » . 
Base' ■tTOTFLTTTT 



Since in Norfolk 10 the first letter which enters into the 
balanced relations discussed above is G, we must place the letters 
of whatever we assume for that message in their proper loci, viz, 
the 5 th letter of the assumed beginning must go under its cipher 
letter Gj the 6 th, under M; etc. Assuming ADJUTANTJGENERAL for 
the beginning of Norfolk 10, we must add the proper letters as 
shown below; 
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A., B C - 

AAA 
7 G P 

B B B 

G 7 Q 

C C C 

F Q 7 

D D D 

R T U 

E E E 

2 0 X 



o 



3 3 3 
U X R 

*44 

J z i 

5 5 5 

M I Z 

6 6 6 

0 2 Y 

7 7 7 
ABC 



FIG . 20 



JL 

AN 

BP 

CE 

DX 

EC 



Q 

AH 

BC 

CB 

DV 

EP 

FG 

GP 

HA 

IZ 

JM 

K0 

LS 

MJ 

3Nl6 

OK 

PS 



K 

AW 


W 

Tnr 

BR 

CX 

DG 


P2 

GY 

H6 

ID 

P 


Q7 

RX 

SL 

TU 

UT 


BF““ 


“Eii 


K7 


VD 


CE 


FV 


LX 


WJ 


DI 


GD 


MW 


XR 


EC 


HU 


HA 


Y2 


F2 


• IY 


OQ 


ZI 


GY 


JO 


PB 


2Y 


H6 


KM 


QO 


yr! 


ID 


LE 


' RS 


45 


J3 


MK- 


SR 


54 


K? 


W5 


T5 


6N 


LX 


OJ 


U4 


7Q 


MW 


PS 


VZ 




m 


Q3 


WM 




OQ 


RB 


XL 




PB 


SP 


YG - 




QO 


TA 


ZV 




RS 


UH 


2F 




SR 


VF 


3J 




T5 


¥7 


4U 




U4 


XC 


5T 




VZ 


YI 


6H 




WM 


Z2 


7 K 




XL ' 


2Z 






YG 


3Q 






ZV 


46 






2F 


5H 






3J 


64 


& 




4U 


7W 






5T 








6H 








7K 
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Base Z3RMGG LE 

Assumed plain text) 

for Norfolk 10 ) TANT3GBNE 

experimental cycle) 



Base 



z 3 R 



M G G L E 



o 



o 



o 



Assumed plain text 
for Norfolk 10 



TANT3GEN. . o 
ANT3GENE , „ 



1st resultant 



2J-P43B5®. • . 



Let us now set up the sliding alphabets 2, J, P, 4, 3, E, 

5, and N, and then try out the various possible beginnings for . 
Hoboken 20, the other experimental cycle. When TRANSPORTATION 
Is tried, the results are as shown In Fig. 22. 
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From the sequence L E Y 3 E Q the word EQUIPMENT soon made 
itself apparent. A feu more letters (PMENT3) were tried out to 
make sure s and very soon, since these yielded good plain text in 
the other two cycles , it was clear that the cipher system had 
indeed been solved and the challenge successfully met. 

The keys were then reconstructed, additional messages being 
utilized to expedite the process j they were then tested on new 
messages and found to be correct. 

It should be clear that this method of using sliding alpha- 
bets can be applied to s case where the beginning points of two 
messages are not close together. In such a case, given one of 
the experimental cycles as involving a beginning of a message, 
possible beginnings are assumed for it and then the sliding alpha- 
bets are brought into play by assuming high frequency polygraphs 
for the interior of the other experimental cycle and testing the 
results on the third confirmative or third cycle. 

* * * ■» 



In the preceding method It was necessary to assume plain text 
for two cycles and test the assumptions on the third. We shall 
now show how plain text may be assumed for only one cycle and the 
correctness of the assumption tested on the other two cycles 
simultaneously. We shall use for examples lew York 2, Norfolk 9 » 
and Hoboken 19 • 



HEW YORK 2 
Cycle -74 



NORFOLK 9 
Cycle -75 



HOBOKEN 19 
Cycle -76 



Upper key loci 
Lower key loci 
Cipher 

Upper key loci 
Lower key loci 
Cipher 

Upper key loci 
Lower key loci 
Cipher . 
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The base is as follows: 



Base 



P V B. Q 
P Q U 2 
E P Q U 
DPZM 
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5 

2 

C 

F 



V L 
U N 
5 U 

z w 

1 nr 



Let us assume for the plain text of Norfolk 9 the likely end- 
ing, 30FFICER, and find the first resultant. In order to apply 
the assumed text to the base in this - case, it will be necessary to 
find what we have termed the MEAN VALUES of the assumed text. 

These are simply the sums of the successive letters of the plain 
text taken In pairs. They have been termed mean values because 
they constitute the means in our balanced sets or proportions. 



For example, the mean values of the word 30FFICER are as 
follows : 



Plain text 



l A A A A A A / 

M Y 7 J 4 K J 
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The mean values are now applied to the base, yielding the 
first resultant a,s follows t 

Base 4 3 0 C S H R 

Mean values M Y 7 J 4 K J 

First resultant ITo STS E 

The sliding alphabets are now brought into play, and an attempt 
is made to produce intelligible test on two lines made up of a 
pair of letters on each alphabet. Note the following set up in 
Fig. 23 and the plain text given by the lines indicated. 

This method of making an initial break into three sequent 
cycles makes it very practicable to work with the case where the 
beginning points of two messages are not close together. Given 
one of the experimental cycles as involving the beginning of a 
message, assumptions of probable addresses are made, and then the 
sliding .alphabets are brought into play by assuming for the 
interior of the other experimental cycle high frequency polygraphs 
such as 44233333, 6M533, 6R53> 3THE3, 30F3THE3, etc. The results 
of the assumptions are tested on the confirmative cycle. 

« * » « 

The relations existing between the experimental and the con- 
firmative cycles may assume three general cases ; 

1. the two experimental cycles may be the first and 
second of three sequent cycles, whereupon the confirmative cycle 
is the third of the series; 

2. the two experimental cycles may be the second and 
third of three sequent cycles, whereupon the confirmative cycle 
is the first of the series; 

3. the two - experimental cycles may be the first and 
third of three sequent cycles, whereupon the confirmative cycle 
is the second or middle one of the series. 

To continue the analogy with the relations in a proportion, 
in the first case, the upper experimental cycle constitutes one 
of the extremes; the second experimental cycle constitutes the 
two means; and the confirmative cycle constitutes the other 
extreme. The second case is the same as the first. In the third 
case the experimental cycles constitute the extremes, the confirm- 
ative, the two means. The third case is therefore considerably 
different from the first two in that in the first two cases we 
have given (or rather assumed) one extreme and both means, leaving 
only one unknown, viz, the other extreme, to be determined; whereas 
'in this case we have given (or rather assumed) both extremes and 
still have two unknowns, viz, both means, to be determined. Were 
it the case that one and only one isolated balanced set were con- 
cerned in Case 3, there would be no way of finding both means; but 
the fact Is that a series of balanced sets is involved, and that 
fact coupled with the fact that the two unknown means of each 
balanced set combine with the adjacent pair of unknown means to 
form intelligible text enables us to select from thirty-two pairs 
of unknowns for each balanced set the pair which, when united 
with one of thirty-two pairs for its neighboring balanced set 
forms intelligible text; and this process continued results in 
the production of plain text for the confirmative cycle. Exactly 
what is meant will become clearer in an example. We* shall give 
the correct plain text for all three cycles first, and then take 
up the cipher letters alone. 
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MESSAGES 

S Q T P N V R 
OBNTOKABD 
Z' 0 N E 3 P I 
KPTUTHI 



S Q T P N V R 
BJiTOKABD 
RTMEIT3 
P J M X K F Q 

*T P N V R 
OKABD 
C H I E P 

I P D I C 

# * * * 

* 

II N P T U T M K 

P J M K K P Q 

ill P D I C 



U T M K . o . 

K K P Q , . . 

M £ £ F o o © 

I F P I O » O 
Base: L X Q W 7 7 

Assumed plain text for Cycle Jr. C H I E F 3 » 

First resultant: HD Z L « . « 

To the first resultant let us add Z0NE3EINANCE, the assumed 
plain text of the other experimental cycle, viz. Cycle 1. The 
first letter which enters into the relations is the E of ZONE. 

First , resultant : M D Z L „ <> » 

Assumed plain text for Cycle 1: E 3 F-’t ° ° 

Second resultant: X P M H . » <> x 



Let us 


consider 


now the first 


three balanced sets in our 


rela- 


tions : 
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Plain text 


CHI 







CYCLE 1 



Upper key 
Lower key 
Plain text 
Cipher 



CYCLE 2 



CYCLE 3 



Upper key 
Lower key 
Plain text 
Cipher 

Upper key 
Lower key 
Plain text 
Cipher 

* 



Cycle 1 
Cycle 2 
Cycle 3 



1 Experimental’ 
Confirmative^ 
Experimental^ 



The letters of the second resultant are shown in their proper 
places in Cycle 2. The first letter of the series, viz, X is the 
sum of two plain text letters represented by P^ and P 2 ; the second 

letter of the series, viz, P, is the sum of two plain text letters 
represented by P 2 and Pj. If, therefore, we assume Pj_ to have any 
value, say A, we can derive, successively, the values of P 2 , P^> P 4 , 
. . Thus : 
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Jf thea PgsA^Xa?! P^sV^FaWj Ptys>H*M~Kj p^^S^H-^6 

♦ ' 

Gpo® this assumption th© plain text of to® confirmative cycle 
would read A 7 W K 6, which is obviously Incorrect* 

V® could proceed to find the value of this series based upon 
various assmed initial values of P^, ta&Ing the letters of the 
alphabet in succession* Let us see wh&fc we get when we assume 

Pj a Mo 



If P^sSSx, then PgsM^Xgl.; P^gS^PgBj 



Pjj, s Ki> M s Tj P^sT-^Ksl 



Here w® have excellent plain text, M E 1 T J. 



He say eliminate all the trials necessary to find the value 
of P^ by the us® of sliding alphabets. Assuming P^ to have the 
value of 7s> the value of Pg, P 5 .** is found in the following 
manner , starting with the second resultant X F M H derived as shown 
on page 55 s 



Second Resultant 
Third resultant 



X F 
1 X 

t $ 



E4 

T 

f 



H 

H 



or 



P 1 p 2 p 3 
7 X T 





Setting up the letters indicated in the third resultant on 
the ordinary sliding alphabets of the cipher square s we have what 
is shown in Fig. 24* 



7IT10 
I fW ! $ 
B 3 D Y S 
CH2? 
DHBSZ 
EHZFB 
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GU E P 2 
HD301 
I 6 P R V 
J P 6 U V 
E L 5 A Q 
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Y 4 3 B F 
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52SO 

6 i J a a 



FIG. 24 



Here the correct generatrix becomes visible 
almost instantly by giving intelligible text. 

The choice of 7 as the basic or assumed value 
of P means nothing in itself, for any other of 
the thirty “two letters of the alphabet might be 
used as a base, with the same results. For 
example, supposing, as before, we start with a 
as a base, we get the third resultant shown 
below i 

? 1 P P p 3 p 4 p 5 
Second resultant * x £* Bi 

Third resultant A V W ' K 6 

' 

Setting these alphabets up, we find that the 
generatrices are exactly the same as those produced 
above, but they are in a different order, as shown 
in Fig. 25» 

The mechanics of the process should be clear. 
Each of th® letters of the second resultaht, X, F, 
M, H, ... represents the union of a pair of means 
in the proportions mentioned on page 52. The 
pair of means of adjacent proportions have one 
member in common. This fact, together with the 
fact that the succession of means must form 
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Intelligible text, makes the process capable of yielding the 
desired results. 
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SLIDING OP ASSUMED PLAIN TEXT 
TO FIND ITS CORRECT LOCUS 

It has been stated above that not only must the correct plain 
texts be assumed In two different cycles but also these texts 
must, of course, be assumed In the correct loci in those cycles. 

Proceeding upon the theory that messages emanating from 
Norfolk, New York, and Hoboken are more likely to go to Washington 
than to other points. It seemed feasible to assume as the plain 
text of the beginnings of certain messages WAR5DEPARTMENT2WASHINGT0N 
3DC3, the problem then being to find the correct loci of the phrase 
in each of two cycles. An example will serve to make the process 
clear. Note the three sequent cycles below. In which WARjJDEPART 
MBNT2WASHINGT0N3DC3 is assumed to occur in experimental cycles 2 
and 5 near the beginning of the messages. 
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Upper key loci 192 202 212 

Lower key loci 266 276 286 

N.Y. 2 (Cycle -?4) . „ .6XTSQWQ2KWCMCFWIDY3GD3A6JM3ZE6EErD4FZRLR. . . Con. 



Upper key loci 
Lower key loci 
NOR. 10 (Cycle -75) 
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267 



202 

277 



212 

287 



SXH7Ga®RHP3QSNI3MCZYCTRV000MYNUS4T64AAZy. . . Exp 



Upper key loci 
Lower key loci 
HOB. 20 (Cycle ~? 6 ) 



192 202 212 

268 278 288 

3CTPJIimS5F4PKQ5LD13SQUGEPWGV0L34WV. . . Exp. 



It is possible, of course, to begin by placing WAR3EEPARTMENT 2 
WASHINGTON at any of the likely loci of Cycles -75 and - 76 , re- 
construct the keys and try them on Cycle -7^» If no good text 
results, the phrase would be moved one space to the left or right 
in on© of the cycles, say the second, and the keys reconstructed 
again. Thl 3 process would be continued until the phrase had been 
shifted to all possible loci in Cycle -76 (within the section under 
examination) , keeping the locus of the phrase stationary in Cycle 
-75» If no good results were obtained, then the phrase in Cycle 
-75 would be shifted one space to the right or left and the whole 
process of shifting the same phrase in Cycle -76 would be gone 
through again. In a section of 25 letters in length with a phrase 
25 letters In length al3o, 50 x 50 or 2500 trials would be neces- 
sary to exhaust svery possibility. The labor and time of making 
such a test ; being very great, a short cut was devised, which 
reduces the work enormously. Sliding alphabets of a special kind 
are used. They consist of a simple rearrangement of the horizontal 
lines of the cipher square, according to the order of the letters 
of the phrase to be tested. If the phrase be WAR3DEPARTMENT2 
WASHINGTON, then the W row of the cipher square is written first, 
followed by the A row, then by the R row, etc., until all the rows 
have been arranged accordingly'. The modified cipher square then 
has the following form: 



\ 



WAR3DBPARTMENT2WASHINGT0! 



YABCDB'FGHIJKLMNO 
¥ T R X G L V TP!! Y 0 H“E K 5~ J* 
AYGFR2CBQS4NZ5K6 
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2E6NJAK0P3DFTVCG 
VTRXGLVDUY0KES5J 
A7GFR2CBQS4NZ5X6 
S IMJ I 5 A 5 z A C R Q B D J 
E Q F G X Y B C 7 L 5 6 I A 0 H 
IS5AXU JHL7PDHGRV 
NKY23FEP0RUAYT-7H 
GBAHW6Q7CMZY4IP2 
IVDVBZXR3P 6 5 2 JM4 
06EPZBY2NVW1QR3H7 
NSY2SFEP0RU^VT7H 
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The columns are then cut apart, and mounted on strips in the 
form of sliding alphabets, ready for use. The method of use, em- 
ploying the principle of balanced sets, will be illustrated in the 
case of the three cycles forming the basis of the preceding analysis. 
Ve shall starts by assuming that the phrase WAR JDE PAR TME NT 2 WA SH INGT ON 
.is in locus 192 of experimental cycle -75s &s the beginning phrase 
267 

of Norfolk 10, The base and the first resultant are derived in the 
usual asanner, and are as shown below! 



NEW YORK 2 
CYCLE =74 
(CONFIRMATIVE ) 



Upper key loci 192 

Lower key loci 266 

Cipher . . . . 6XTSQWQ2KWCMCPWIDY3GD5A6JM5ZE6EKTD4PZRL . . 



NORFOLK 10 Upper key loci 
CYCLE “75 Lower key loci 
(EXPERIMENTAL) Cipher 

Assumed p. t. 



* o 



192 

267 

. 3QSNI3MCZVCTRVOUOMVNUS4T64AAZY- 
. WARJDEPARTMENT 2WASH INGT ON - * • 



HOBOKEN 20 Upper key loci 
CYCLE -76 Lower key loci 
(EXPERIMENTAL) Cipher 



192 

268 

. . . XXLKJF 4PKQ5LDYEQUGE PWGV 0L3 4WV „ . 



Base 

Assumed plain 
text for NOR 0 10 

First resultant 

The sliding alphabets indicated in this first resultant are 
then set up in a "staggered" manner, as shewn below in Fig. 27 . 

If the hypothetical phrase in Cycle -75 is really in the locus assumed, 
and if it also is contained anywhere within the section included in 
Cycle - 76 , then intelligible text must appear on some, generatrix 
of the set-up. 

Should it happen that the locus of the first letter of the 
phrase in both cases falls within the same column, that is under 
the same "long key" letter, the uncovered plain text for Cycle -74 
will occupy the longest generatrix; that is it will begin with 
the second letter on the first strip (the letter immediately below 
the letter designating the alphabet) and will continue all along 
the generatrix, provided no breaks occur in the phrase WAR 3DE PART 
MENT2WASHINGT0N, as assumed. If a break should occur, for example, 
should the phrase be WAR3DEFARTMENT6N53WASHINGT0N , then the tin- 
covered plain text for Cycle -74 will appear on two generatrices, 
separated by four letters giving unintelligible text. 

Should the phrase in Cycle - 76 begin one letter to the right 
of where it begins in Cycle - 75 , the plain text will appear on the 
generatrix which begins with the second letter on the second strip, 
and so on upwards until, if the phrase in Cycle -76 should begin 
under the next to the last letter of the phrase in Cycle -75, only 
one letter of the plain text for Cycle -74 will be given by the 
set-up, viz, the second letter on the last strip. Should the 



MCPWIDY3GD3A6JM3ZE6EKTD4 

QSNI3MCZVCTRV0U0MV N^U S 4 T 6 
3 S'S I I3MC Z V CTRV 0U OMVNU S 4T 
XXLK3F4PKQ5LDYEQUgEPWGV0 

V A R~ 3 D E P A R T M E ItItIThTITTIi 
AR3DSPARTMENT2WASHINGT0N 

2 T A 6 4 7 G 3 7 2 0 1 G R W H H 4 G PlTTf 



- 59 - 




REF ID : A4148948 



UfM 
FIH R 

JjT 3 s 

PJ 6 CP J 
GjS JUH 
A|D Y 2 D C C 
Hj 6 B M R 5 I B 
UJTLERZR 

































¥]S 


Q 


2 


V 


5 


D 


6 


3 


S 






























R 


7 


5 


V 


R 


¥ 


Q V 


C 


F 


5 




























A 


rs 


T 


P 


T 


E 


6 


7 


J 


U 


Q 


¥ 


























I 


P 


D 


B 


0 


X 


D 


R 


Y 


2 


X 


6 


C 
























A 


fy 


B 


7 


Q 


Y 


Y 


V 


B 


M 


0 


Z 


I 


A 






















2 


jj 


s 


T 


C 


G 


X 


2 


J 


T 


I 


H 


R 


J 


5 




















7 


jf 


6 


H 


V 


A 


L 


R 


Q 


2 


ft 


R 


D 


E 


Q 


F 


















3 


]¥ 


E 


L 


2 


¥ 


J 


S 


5 


V 


0 


I 


Q 


3 


X 


S 


M 
















G 


IS 


A 


4 


M 


X 


6 


M 


T 


P 


3 


H 


6 


G 


0 


K H 


R 














A 


JD 


U 


R 


I 


Z 


U 


R 


D 


B 


N 


4 


D 


P 


I 


R 


V 


3 


R 












A 


io 


B 


c 


3 


J 


B 


T 


B 


7 


A 


7 


Y 


3 


R 


H 


6 


C 


2 


6 










6 


|6 


4 


T 


7 


D 


A 


C 


S 


T 


G 


K 


X 


0 


0 


0 


S 


J 


4 


¥ 


D 








A 


pr 


J 


E 


V 


F 


E 


H 


6 


R 


R 


P 


L 


T 


3 


R 


D 


Y 


F 


B 


E 


A 






A 


1? 


0 


2 


K 


¥ 


S 


P 


E 


L 


P 


I 


J 


5 


R 


P 


6 


B 


¥ 


M 


J 


J 


Y 




2. 


]6 


7 


z 


H 


2 


6 


L 


A 


4 


4 


G 


6 


I 


A 


V 


U 


J 


5 


2 


C 


E 


X 


5 


1* 


Z 


J 


D 


5 


E 


R 


N 


0 


R 


L 


3 


U 


P 


G 


Z 


K 


Q 


F 


C 


T 


3 


Q Q 


Q 




E 


2 


D 


L 


D 


X 


B 


C 


T 


V 


B 


R 


R 


4 


7 


5 


Z 


M 


M 


G 


L 


X 


5 


A 


31 


4 


R 


R 


G 


V 


4 


T 


H 


M 


A 


H 


P 


0 


B 


T 


B 


7 


C 


P 


R 


0 


Y 


J 


1 


4} 


I 


E 


2 


F 


J 


E 


R 


0 


E 


C 


4 


3 


D 


D 


P 


A 


L 


3 


7 


I 


T 


E 






51 


J 


D 


y 


0 


2 


6 


I 


S 


R 


L 


G 


Y 


B 


K 


U 


G 


0 


L 


R 


C 


3 








6\i. 


A 


V 


7 


Z 


0 


Q 


6 


4 


T 


7 


J 


S 


5 


V 


Y 


T 


C 


0 


2 


G 










n 


H 


J 


D 


J 


H 


R 


p 


H 


2 


Z 


6 


A 


C 


N 


5 


I 


3 


T 


P 












k 


E 


Z 


¥ 


U 


D 


U 


R 


I 


¥ 


E 


X 


L 


M 


I 


D 


R 


R 


3 














91 


4 


0 


5 


G 


3 


6 


0 


Q 


A 


U 


R 


7 


P 


T ' 


A 


3 


0 
















lot 


L 


H 


2 


Q 


0 


D 


D 


u 


S 


P 


V 


R 


7 


G 


J 


T 


















11;. • 


V 


D 


K 


J 


R 


0 


B 


E 


H 


3 


H 


M 


R 


L 


5 




















12 


A 


3 


¥ 


B 


6 


4 


5 


T 


I 


C 


2 


P 


2 


I 






















13$ 


C 


0 


E 


4 


J 


0 


C 


2 


R 


0 


4 


V 


P 
























14. 


L 


R 


T 


c 


F 


5 


M 


4 


G 


L 


7 


R 


























15. 


7 


6 


7 


V 


M 


F 


P 


V 


T 


G 


H 




























I 60 


Z 


J 


I 


K 


c 


D 


7 


H 


0 


C 






























17. 


E 


F 


Q 


X 


3 


Z 


R 


M 


R 
































18. 


U 


M 


S 


Q 


L 


6 


2 


4 






V 




























19. 


P 


C 


K 


E 


0 


¥ 


P 




































20. . 


3 


3 


B 


J 


T 


U 


• 




































21. 


c 


L 


¥ 


A 


3 








































22. 


0 


0 


6 


Q 










































25 = 


L 


T 


K 












































24. 


G 


3 
















> 































25 . C 



FIG. 27 



phrase in Cycle -76 begin one letter to the left of where it begins 
in Cycle -75 » the plain text will appear on the generatrix which 
begins with the third letter of the first strip and so on downwards , 
the reverse of what was set forth above. In other words, by keeping 
¥AR2DEPARTMERT2¥ASHIRGT0R in the locus shown in Gycle -75 in the 
textual diagram above, this one set-up of the special sliding 
alphabets is equivalent to having slid the same phrase in Cycle -76 



-60- 




REF ID : A4148948 

fifty times. Examining Pig. 27 in the light of the foregoing dis- 
cussion, no good plain- text is discovered on any generatrix, nor 
do we find even a fragment of intelligible text sufficient to justify 
further experiment with this set-up. We proceed thereupon to move 
the phrase one space to the right in Cycle -75» 



Going through the same steps as shown on page 59s with 

the same assumed phrase in Cycle -75 (WAR3DBPARTMENT2WASHINGT0N) 
but beginning under the letter Q instead of 5 , we have the follow- 
ing; 



Upper key loci 
Lower key loci 
M.Y. 2 , Cycle -7 1 * 



192 

266 

6XTSCMCPWIDY3GD3A6JM3ZE6EKTD4PZRLR 



CONFIRMATIVE 



Upper key loci 
Lower key loci 
NORFOLK 10, Cycle -75 



192 

267 

3QSKX3MCZVCTRV0U0MVNUS4T6UAZY 

WAR3DEPARTMENT2WASHXNGT0N 



EXPERIMENTAL 



Upper key loci 
Lower key loci 
H0B0EKN 20, Cycle -7 6 



192 

268 

XXLK3F 4 PKQ 5 LDYEQUGE PWGV 0L3 4VW EXPERIMENTAL 



BASE 



Z3OFH00WHDPJ3YX25BCHZSWO 



If the second generatrix, omitting the first letter, of the 
preceding set-up of alphabets (Fig. 27} be united with the phrase 
WAR3DEPARTMENT2WASHINGT0N, we get the same base as is indicated, 
here when the phrase is moved one letter to the right in Cycle -75* 

Thus % 

2d Gen. of Fig. 27 * (E)'2 ULDXBCTVBRR 47 5 2 H M 6 L X 5’« 7 
Assumed plain text WAR3DEPARTMEL NT2WASHINGT0 

Derived new base T 3WtilTrDiTT!TrTrmiTo 



This means that once a set-up such as that of Fig. 27 is made, 
new or additional write-outs of cycles as the assumed phrase is 
slid, need not be made; the proper bases can l?e derived as shown 
by the foregoing example from a single write -out of cycles and 
assumed plain text. 

The sliding alphabets indicated by the foregoing derived base 
(it . is really a "first resultant") are then set up as before, and 
the various generatrices are examined with a view to finding plain 
text. The set-up given in Fig. 28 shows a generatrix containing 
intelligible text consisting of a sequence of eight letters, 

N G 3 T 0 3 S 6 . Note the generatrix which is underscored. It 
means that we have struck the correct loci of at least a part of 
our hypothetical phrase in Cycle -75 and Cycle -76. We can ascer- 
tain what parts are involved from the position of the plain text 
in Fig. 28. For the fact that the plain text, vis, NG3T03S6, 
begins Immediately after the "letter" 2 , designating the generatrix, 
means that the hypothetical phrase in Cycle -76 begins with 
WAR3DE ... etc. The fact that this generatrix is the 16th of the 
set-up means that in Cycle -75 the hypothetical phrase begins with 
the-.l 6 th letter which is the W of WASHINGTON. In other words, 
the loci of the hypothetical phrase are as shown herewith; 
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HEW YORE 2 
CYCLE -74 
(CONFIRMATIVE) 



Upper key loci 
Lower key loci 
Cipher - . - „««, 
Plain text 



186 196 v 206 216 

260 270 280 290 

6XTSQWQZKWCMCPWIDY3GD3A6JM3ZE6EKTD4PZRIR . . 

. „.l?G3T03S6 o . . 



NORFOLK 10 
CYCLE- -75 
(E&FBRIMBNTAL) 



Upper key loci# 
Lower key locif 
Cipher • . « 
Plain text 



186 

261 



196 

271 



206 

281 



216 

291 



ISXH7GMERHP3QSNI3MCZV CTRV OU QMVNUS4T64AAZY 

. ..WASHINGTON.. . 



HOBOKEN 20 Upper key loci 
CYCLE -76 Lower key loci 
(EXPERIMENTAL) Cipher 

Plain text 



186 

262 



196 

272 



206 

282 



216 

292 



1I3CTFJIXXLK3F4PKQ5LDYEQUC-EPWGVOL34VW 
I* .. 0 WAR3DEPARTMENT„ 



With this as a start, the keys can be reconstructed and the 
decipherment continued. 

*«**■»' 



A variation of the foregoing method makes use of special sliding 
alphabets based upon the hypothetical phrase, the presence of which 
is suspected in both experimental cycles. These sliding alphabets 
are built exactly like those based upon the phrase WAR3DEPARTMENT2 
WASHINGTON, except that instead of using the sequent letters of this 
phrase in constructing the alphabets, the mean values of the letters 
,of the assumed plain text are used. The mean values of the phrase 
under discussion are as follows ; 



' V- . «. '■j ^ 

Mean values 



K A B 3 D E PARTMENT 2WASHINGT 0 N 3 D C 
AR3DEPARTMENT2WASHINGTON3D“C3 
¥TXTTF4 q Y fcifxTFL z f i z l fpR'TlfllTB 



Sliding alphabets are now made by first constructing the square 
shown in Fig, 29 and then cutting the columns apart. 
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Then by setting up the alphabets indicated by the letters of 
the base in staggered fashion a3 before s the successive first 
resultants will be found in successive generatrices. Bote that 
the tvo generatrices used in the preceding discussion appear in 
the set-up in Fig. 30. 
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In the preceding example the assumptions for the plain text 
Involved the hypothetical presence of the same phrase in both 
experimental cycles. We shall now proceed to a consideration of 
the case where the assumed plain text is not the same for both 
experimental cycles. The procedure is basically the same as in 
the preceding case. The messages to be used for the demonstration 0 
are three actual messages of the series. The base has been derived 
in the usual manner, and to it is applied the assumed beginning, 
TRANSP0RTATI0N3SERVICE, for Cycle -7 6, one of the experimental 
cycles, yielding the first resultant shown below: 
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Base ...... FL C 4 Y 5 2 j T“S"pT 

Assumed p.t. for}........... TRANSPORTAT 

Cycle -76 ) 

1st resultant GOFJTDGCYYO 

Since New York begins somewhat in advance of the locus where 
Hoboken 21 begins, and since it is probable that the former message 
is going to Washington, we assume that the phrase WAR3UEPARTMENT2 
WASHINGT0N3DC3 occurs somewhere in the vicinity of loci 395 to 423 
of the upper key. 

The special alphabets based upon the phrase WAR3 etc. are set 
up in the manner shown below in Pig. 31. Of course, no plain text 
can be visible as yet because the confirmative cycle in this case 
is the middle cycle, and we must apply the principles elucidated 
on pages 33 - 56 . 

The steps are the same for every generatrix of the set-up, 
and we will take only the correct generatrix for the demonstration 
of the method. The correct generatrix is, of course, found only 
by trial. The method in brief is as follows: 

Taking the correct generatrix, which is as follows: 

OJCEJKPHSFH 

and going thro ugh the usual steps, to determine the series of v 
unknown means, we have: 

' P 1 p 2 p 3 P 4 p 5 p 6 p 7 p 8 p 9 P 10 P 11 P 12 
0JCE3KPHSF-H 
70WXM0QEYTX 
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Setting up thi3 series of letters in the ordinary aloha bets we 
have the following! FIG. 32),; 

























0 


1 


0 


W 


X 


M 


0 


G 


E 


Y 


T 


X 


D 






















Y 


j 


A 


3 


T 


V 


5 


T> 


H 


2 


T 


T 


•Xmjii »::■ — urm. 

IHt 




















Y 


I 


6 


B 


E 


R 


3 


S 


E 


C 


0 


N 


D 


3 


T 


















C 


I 


P 


L 


C 


P 


X 


W 


L 


P 


B 


K 


6 


V 


¥ 


U 
















G 


X 


P 


5 


M 


D 


Z 


G 


H 


Y 


Z 


V 


4 


M 


B 


H 


7 














D 


D 


F 


5 


z 


z 


E 


B 


L 


M 


X 


B 


P 


7 


H 


Z 


H 


4 












T 


G 


B 


3 


Z 


M 


B 


F 


Y 


V 


T 


Z 


Y 


G 


N 


0 


X 


T 


3 










3 


A 


R 


T 


R 


M 


E 


C 


G 


2 


D 


U 


I 


2 


P 


6 


X 


R 


U 


¥ 








F 


ft 


W 


A 


V 


U 


H 


A 


6 


H 


H 


U 


D 


4 


N 


A 


Y 


E 


3 


D 


X 






0 


V 


U 


G 


F 


W 


X 


A 


P 


L 


I 


V 


Y 


6 


G 


V 


Z 


U 


W 


P 


6 


E 


1 . 


G 


J 


C 


C 


H 


7 


6 


0 


P 


5 


4 


J 


W 


0 


P 


ft 


W 


M 


R 


V 


6 


P 


2 


2 . 


D 


6 


TJ 


7 


B 


4 


W 


F 


5 


3 


3 


X 


ft 


M 


L 


V 


ft 


0 


C 


G 


5 


L 


I 


3. 


B 


L 


D 


F 


Z 


5 


B 


3 


3 


D 


B 


L 


R 


E 


E 


c 


R 


S 


¥ 


TJ 


2 


K 


6 


4. 


T 


M 


3 


S 


I 


R 


T 


V 


D 


H 


E 


M 


3 


E 


E 


7 


3 


J 


X 


D 


N 


E 


Y 


5“ 


V 


Z 


N 


L 


W 


A 


R 


L 


H 


B 


4 


N 


H 


5 


Z 


T 


H 


6 


F 


B 


M 


Z 


S 


6 . 


W 


B 


6 


U 


G 


B 


I 


K 


B 


S 


G 


0 


7 


J 


S 


3 


7 


K 


B 


F 


4 


s 


Z 


7. 


6 


C 


C 


c 


7 


Y 


6 


2 


S 


ft 


J 


P 


0 


s 


J 


R 


C 


E 


ft 


A 


I 


J 


5 


8 . 


N 


6 


u 


H 


N 


4 


? 


V 


ft 


I 


6 


0 


E 


3 


R 


J 


K 


7 


P 


2 


U 


R 


V 


9. . 


B 


L 


X 


0 


Z 


S 


R 


N 


I 


P 


X 


R 


L 


B 


ft 


P 


L 


X 


J 


5 


G 


ft 


A 


10 . 


T 


4 


z 


s 


M 


B 


0 


X 


P 


T 


N 


S 


X 


P 


0 


B 


X 


L 


3 


T 


Y 


0 


K 


11 . 


R 


3 


N 


4 


7 


J 


D 


F 


T 


E 


V 


T 


4 


A 


F 


N 


4 


TJ 


z 


3 


7 


F 


B 


12 . 


I 


B 


E 


H 


L 


G 


B 


J 


E 


W 


H 


TJ 


5 


H 


G 


6 


5 


T 


1 


L 


.ft 


G 


C 


13. 


6 


H 


X 


I 


A 


R 


5 


G 


W 


B 


2 


V 


I 


F 


A 


2 


I 


D 


5 


J 


C 


A 


ft 


14. 


P 


4 


K 


ft 


W 


N 


C 


4 


B 


K 


4 


W 


J 


7 


C 


E 


J 


3 


L 


I 


A 


C 


G 


15. 


R 


G 


V 


U 


Y 


X 


M 


2 


K 


S 


7 


X 


S 


C 


7 


E 


S 


R 


M 


4 


F 


7 


H 


16 . 


0 


J 


C 


E 


3 


K 


P 


H 


3 


F 


H 


Y 


F 


I 


4 


D 


F 


2 


H 


7 


S 


4 


M 




i r 


YT 


T 


W 


T” 


IT 


7 


T“ 


F" 


B~ 




2 


D 


2 


N 


F 


D 


I 


T 


3 


E 


N 


0 




B 


X 


B 


2 


M 


W 


R 


P 


B 






2 


G 


Z 


5 


V 


G 


Y 


A 


ft 


L 


5 


J 




5 


N 


J 


4 


R 


B 


2 


2 








3 


M 


ft 


B 


0 


M 


¥ 


S 


Z 


H 


B 


F 




G 


V 


E 


V 


7 


Z 


P 










4 


T 


6 


Y 


H 


T 


5 


D 


X 


0 


Y 


E 




M 


H 


ft 


H 


4 


S 












0 


TJ 


N 


2 


A 


U 


4 


V 


R 


E 


2 


P 




P 


2 


X 


M 


M 














6 


A 


4 


I 


TJ 


A 


N 


G 


C 


J 


I 


L 




7 


4 


Y 


4 
















7 


0 


W 


X 


M 


0 


ft* 


E 


Y 


T 


X 


D 




R 


7 


E 












































2 

P 


H 




















' 












- 


















FIG a 


31 












' 






FIG 


!■» 


32 












The 


plain 
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eminently. 



Counting down the first alphabet of the set-up shown in Fig. 31 » 
we find that it is the 16th letter of our phrase ¥AR3BEPARTB®NT2 
WASHINGTON,, which begins the hypothetical phrase in Cycle -74, 
i.e., the word WASHINGTON occurs in New York 3 s beginning with 
locus 405. With the section BER3SEC0ND3T as s start , it is not 
difficult to add to the plain texts of all three cycles. The keys 
can be reconstructed simultaneously with the building of the plain 
texts. The proper placements of the initial texts are shown 
herewith: ' ! f 
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Upper key loci 
Lover key loci 
SLY. 3 (Cycle - 7 *) 
Plain text 

Upper key loci ' 
Lover key loci 
NOB. 10 (Cycle -75) 
Plain test 



D95 403 

469 477 

Jo ... o Z T D M 7 

I o . . . 2 W A S H 

403 
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. . . D 4 G 7 Q Y 

. . o B E R 5 3 



J X 
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G 0 



U P K X o 
GS 01 . 
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N D 3 T . 



o 



o 



Upper key loci 
Lover key loci 
HOB.’ 21 (Cycle -76) 
Plain test 



1403 

479 

OTIAQOIGPST . . . 
TRANSPORTATION® 



* * 



•»> 



Upon proper occasion it my be desirable to slide two different 
phrases against one another. For example , WASHINGTON against 
NEW3Y0RK, The methods discussed in the two preceding cases have 
been elucidated sufficiently, it is believed to show that such a 
process would be perfectly practicable. Special sliding alphabets 
would be prepared and kept on file for use when the occasion ©rose. 

By means of this process, it is possible to test all sorts of 
phrases, such as names of persons or places likely to occur in 
addresses or signatures. Given a sufficient number of messages 
favorable to the application of such a test, the process becomes 
a very valuable adjunct to other methods of attack. 

4. SOLUTION OF CASES NOT INVOLVING THREE SEQUENT CYCLES 

The possession of three cycles in unbroken sequence is no 
longer absolutely essential to solution. We shall discuss the 
following four cases likely to arise in practice. . 

A o . The two experimental cycles sequent, the confirmative 
cycle at a short distance removed from either of the experimental 
cycles. 

1 

B. The experimental and confirmative cycles equidistant. 

C. The distance between the confirmative cycle and the 
nearer experimental cycle is a multiple of the distance between 
the two experimental cycles. 

D. Cycles at irregular intervals from one another. 

The four cases will be studied in succession. 

A. (Case l)— The two experimental cycles sequent, the confirm- 
ative cycle at a short distance removed from either of the experi- 
mental cycles. 

The solution of this case is dependent upon two factors j first, 
how far removed the confirmative cycle is from the two experimental 
cycles! and second, the leqgth of the assumed text. Let us study 
three actual messages. 
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Messages 

/* 




Upper key loci 
Lower key loci 
NOR. 10 (Cycle -75) 


186 196 206 

;! 261 271 281 

it SXH7GMERHP3QSNI3MCZV CTRV 0 . . . 


Experimental 


Upper key loci 
Lower key loci 
HOB. 20 (Cycle - 76 ) 


186 196 206 

.262 272 282 

|| 3CTF JIXXLK3F4PKQ5LDYE ... 

*,4 


Experimental 


Upper key loci 
Lower key loci 
WASH. 25 (Cycle -86) 


186 196 206 

272 282 292 

' . . .KCF7TRQJU3HRM0ZJ6SXXQ . . . 


Confirmative 



In this case we have Norfolk 10 beginning in Cycle -75 J Hoboken 
20 s beginning In Cycle -76; and. Washington 25, in Cycle -86, or 
ten cycles remove^ from Hoboken 20; that is, the confirm tive cycle 
Is ten cycles removed from the nearer experimental cycle, instead 
of being directly sequent, as has been the case In all the examples 
discussed heretofore. It was desirable to obtain a method by means 
of which possible beginnings for Norfolk 10 and Hoboken 20 could be 
tested very rapidly on Washington 25, and the following method was 
devised. , ' 



Reconstruct the two keys without reference to any plain' text 
whatever, using the series of cipher letters only In Cycles -75 
and -76 for the first 15 letters, beginning with 7 as a base -in 
loci 186 * 262 , Cycle - 76 . Thus; 



Upper key loci 
Lower key loci 
Upper key (hypothetical) 
Lower key ” 

Norfolk 10 (Cycle -75) 



186 196 

* 261 271 

\ 0QFHDJEBUCC5BVK 

• 3PU75&PMJ4RAQKZ 

ISXH7GMERHP3QSNI3MCZV. . . 



Experimental 



Upper key loci 
Lower key loci 
Upper key (hypothetical) 
Lower key ” 

Hoboken 20 (Cycle - 76 ) 



186 196 

262 292 

* 70QFHD JEBUjC C 5BVK 
i: 5FU75KPMJ4jRAQKZ0 






Experimental 



Upper key loci 
Lower key loci 
Wash. 25 (Cycle -86) 



186 196 

272 282 

. . .KCF7TRQJU2NRM02J. . . 



For example, starting with 7 as the upper key letter of locus 
186 in Cycle - 76 , the resultant of 7 and 5 is 3 , which becomes the 
lower key letter of locus 262. This then becomes the lower key 
letter above M in Cycle - 75 . The resultant of 5 and M is 0 , upper 
key letter 187 , which Is now placed above C, the second letter in 
Cycle -76, etc. The process Is exactly the same as that In recon- 
structing normal keys, except that no plain text is used as yet. 

Keys produced in this manner, we have termed IMPERFECT KEYS, because 
they are not completed, or made symmetrical by the plain text letters 
which apply, and will therefore not produce plain text when shifted. 
Normal keys, or keys which will produce plain text we have termed 
PERFECT KEYSo 



Since Washington 25 is ten cycles removed from Hoboken 20, then 
the lower imperfect keys of the latter beginning with RAQKZ 
(after the bar In the, diagram) must be united with the upper im- 
perfect keys of the beginning point of Hoboken 20, and these must 
be applied as shown below, to the cipher In Washington 25, beginning 
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with E G P 7 - * • • The series of letters which are produced 
wa tern, as before, the BASE; 



Washington 25 
(Cycle -86) 



Upper key loci 186 

Lower key loci 272 

Upper imperfect keys 7 0 Q P H D » 

Lover imperfect keys R A Q E Z 0 „ 

Cipher S G F T T R 






s y p 2 i 6 



Now it is patent that if w© had included the assumed plain 
test for Norfolk 10 and Hoboken 20 in constructing th® keys, the 
has© would have become the plain text for Washington 25s and had 
the assumed plain text been the correct plain test for those two 
cycles, then the base would have to be intelligible plain text. 
However, whether we include such assumed plain text in the first 
steps, working with perfect keys 3 or apply it after imperfect keys 
have yielded th© base, the final result / will be the same, , providing 
we go through the correct steps. 



It is also patent that although the assumed plain text consists 
of two distinct parte, on© applying to Norfolk 10, the other to 
Hoboken 20, it is perfectly correct to test the effect of these two 
parts separately. That is, we may assume one phrase as th© begin- 
ning of Hoboken 20 and try it in combination with all possible 
beginnings for Norfolk 10, exactly aa was done In 3©ctlon 3. 

Now as far as the first few loci of Washington 25 are con- 
cerned, th© assumption of plain text for Hoboken 20 will have two 
effects: first, upon loci 186 & 187 ... of the upper k©ys, and 
secondly, upon loci 272 & 273 ... of th® lower keys. Let us 
analyse these effects in detail, assuming Hoboken 20 to begin with 
TRANSPQRTATI0N3SERVICE „ 

Locus 186 of the upper key is unchanged, sine© we still retain 7 
as th© base for reconstruction of the keys. Locus 262 of th© lower 
key is affected by the first letter of the assumed beginning, vis, 

T. It would result in producing a letter different than the one 
shown (3) for locus 262 of the lower key and this in turn would 
glv© a different letter in locus 187 of th© upper key. Locus 263 
of th© lower key would be affected again by the second letter of 
th© assumed plain text beginning for Hoboken 20, and this in turn 
would affect locus 188 of th© upper key. In short, th© effect is 
progressive and- cumulative . This series of effects will b© pro» 
dSiced^y = The"^f i <^lo^lig series of letters: 



T T T T T 0 . • 

R R R R * . . 

A A A © o . 

■ H N . o . 



TGB Y T . . o 

Such a series of summations has been termed the PROGRESSIVE 
VALUE of a phrase, and the integral sign placed before a series of 
letters will indicate that the progressive value of the series is 
to be taken. Thus, \ TRANSPORTATION means that th© progressive 
values, letter by letter, are to be taken. 
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This progressive value Must be applied to the base, and since 
the first locus of the upper key to be affected by the plain text 

assumed is 187, we apply the progressive value as shown below % , 

✓ 

Upper key loci 186 187188 I89 190 191 

Lower- key /loci • 272 273 2?4 275 276 277 

Base ■ S • Y F 2 -Y 

Progressive value of 

assumed plain text . , • 

for Cycle -76 T G B Y T 

Sum . , S 3 Q 6 7 J 

t s 

We have so far. found the effect of the assumption of plain 
•test in Hoboken 20 only upon the upper key loci 186 to I90 . Bow 
. we must find the effect upon the lower .key loci from 272 to 276, 
for- they, too, are involved in the process of finding the plain 
test for Washington. 25. 

The first lower key locus affected is 262, by the letter T of 
TRAHSPORTAT 1 OB The next is locus 263 , by the' letter R , and so on. 
The effect is likewise progressive and cumulative. It will be as 
follows, :Ln detail; - 

262 263 264 265 266 267 268 265 270 271 272 273 274 275 276 277 

T T T ' T T T T T T T T T T T T T 

\ . R R R R R R' R R R R R R , R R R 

A A • , A A. A A A A A A A A A A 

K R I H H- H - H H N I I H I , 

'S 1 3 S.S S S ' S 3 S 3 S 3 

PPPPP.PPP PPP 
000000 0 00 "0 

RRR’RRRRRR* 
TTTTTTTT 
A A A 1 A A A A 

T T T ■ T, T T 

I I I ‘I 1 

0 0 0 0 

■ , • • . ‘ * N N H 

3 3 

S 

1 : ~<T B ~™Y T : 1 V H -.3 u ’TF'T 1 ) s 1 3 

3 5 nee the first lower key locus involved is -Washington 25 is 
.272, we begin with the letter 0 . of the progressive value, and apply ^ 
the series to the base- already corrected as regards upper keys. 

Thus S'" , • 

-Upper key loci . 186 

• Lower key loci > 272 

Base, corrected for ) 
imperfect upper key £ S S ^ 6 T J ■> . c 
Correction, fox 5 is- .) , . 

perfect 'lower key J Q Z D 5 K 5 « «■ * 

First, resultant ’ T’XTTTTI, . « 

This series of letters, corrected for upper and lower key letters 
as affected by the plain text 1 assumed for Hoboken 20 , we. term, as 
before, the FIRST RESDLTAHT. 
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The steps Illustrated above are summarized belov in standard 

form; 



186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 



262 263 2 64 265 266 267 268 269 270 271 272 273 274 275 2?6 

T R A Iff S.P 0 R T A T I 0 N 3 S 

T G' Y T I. V H 3 U Q Z D S E 3 



B 



T' 



H 



Upper 
key 
loci 
Lover 
key 
loci 

Progres- 
sive 
value 

Upper key loci ' 
Lover key loci 
Base 

Correction for im-i 
perfect upper keyf 
Correction for im-1 
perfect lover key/ 
First resultant 



186 187 188 189 190 191 . . . 

272 273 274 275 276 277 . . • 

S Y F 2 Y 6 . . . 

T G B Y T . . 

Q 2 . D 8 E 3 ' ; ' . . 

L H V V E K o.o 



We are nov ready to assume beginnings for Norfolk 10. We may omit 
the Incorrect trials and proceed at once with the correct phrase, 
ADJUTANT3GENERAL3ARMY . The steps are practically the same as above. 
The progressive values are sought, beginning vith the second A of 
ADJUTANT, since It falls Under upper key locus 187 , and is therefore 
the first letter which enters Into calculation. 



ADJUTANT3G 
Progressive) _ c _ 
value j A K 5 o E 



Upper key loci , 
Lover key loci 
Second resultant 
Correction for im-} 
perfect upper key I 
Correction for Im-) 
perfect lower key! 
Plain text 



ENERAL3ARMY. . . 

7 N F U 3 PL 2 6 U L . . . 

186 187 188 189 190 191 • 

272 273 274 275 276 277 o . . 

L H V V ‘ E K oc = 

A K 5 6 E... 

3 P L Z 6 U o . . 

P EAT E D . . . 



Having found intelligible plain text for Washington 25, perfect 
keys are constructed In the normal manner and the decipherment 
continued. 



The process described above has been carried out in full detail 
to demonstrate its mechanics. It may be summarized below: 



Upper key loci 
Lover key loci 
Base ; 

Correction for assumed,), 
plain text of Cycle - 76 ) 
First resultant 
Correction for assumed l 
plain text of Cycle -75) 
Plain text for) 

Cycle -86 ) ° ° ° 



186 

272 

, S Y F 2 Y 6 



viT G B Y T 
Q ,Z D S E 3 



L H V V E & 

A K 5 6 E 

P L Z 6 U 



P E A T E D 



) 



£ jTRANSP0RTATI0N3S. . . ) 
C TGBYTIVH3UQZDSE3. . 0 ) 

f ADJUT /ANT3GENERAL3ARMY) 

■ AE56E7NFU3PLZ6UL) 
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This process takes longer to describe than to perform, naturally 
and compared with the time it would take to try put all possible 
, combinations of beginnings by constructing perfect keys in each case, 
it is several hundred times more rapid. The progressive values for 
all possible beginnings, once having been determined, can be kept 
on file so that with all the data at hand the process is extremely 
rapid. 

B. (Case 2) -“Experimental and confirmative cycles equidistant. 

Given three cycles which are equidistant, with two of them 
beginning near the same locus, a solution is possible, provided that 
the assumed text contains three or four more letters than the dis- 
tance between the cycles . ' 

' Example 

Message 1 - Key indicators 500 9 509 (Cycle -9) 

XBCPRAQ40KP6M0XVZAKDHXZ..-. 



Message 2 - Key indicators 505 *316 (Cycle -15) 

WLL02AKDYRJ2WSP0U4HJ0Q. . . . 

Message 5 - Key indicators 100 * 117 (Cycle -17) 

The section beginning with 505 * 520 is as follows; 

« o o 0 D A C'l^.S UU U P 2 T Y 5 K'C 6 . . . 

These messages are arranged as follows; 

500 505 313 

309 512 522 

Message 1 (Cycle -9) X B C P B A Q I 0 I P 6 H 0 X V Z A K D N X Z 

'305 ’ 313 

,316 326 

Message 2 (Cycle -13) WLL02AKBYRJ2WSP0U4HJ 

, 303 ' '■ 313 

v 520 530 

Message 5 (Cycle -17) : ..,GHC IW 8 U U U P 2 T Y 5 K C 6 6 0 

We must first prepare these cipher letters properly so as to 
be able to make trials quickly. The reconstruction of the two im- 
perfect keys is first carried out. Inasmuch as the steps are some- 
what different from the ordinary ones in constructing keys from 
sequent cycles, we will show them somewhat in detail. 

303 ' .. 

• - • - ' - 312 

Cycle -9 X B C P R A Q 4 0 IP 6 H 0 X7Z A ID I X Z 

303 

» . 316 

Cycle -15 WLL0 2AKDYR J 2W SP 0 U 4 H J 

'305 
520 

...GDACXWSUUUP2TY5&C66© 



Cycle -17 
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These cycles are four apart. Let us divide up the three lines 
into sections of four letters, beginning with the letters falling 
beneath upper key 303 . Thus:' 



Cycle -9 

Cycle -13 

/ 

Cycle -17 



X B 





Of 



Since these cycles are four apart, then the construction of 
the two keys from Cycles -9 and -13 must be carried out in intervals 
or periods of four . That is, if we assume the upper key for the 
first of Cycle -13 to be 7, then the lower key would be W. This 
letter W, the 316 th letter of the lower key must then be placed 
above the letter 4 in Cycle -9, that is in the locus designated as 
307lin Cycle -9. The resultant of W and 4, viz, 6 , is then 307th 
316 ) 

upper key letter. Applying 6 to locus|307 in Cycle -13 > we get B 

I320 

for the 320th letter in the lower key. ' This letter applied to the 
locus '311 in Cycle -9 gives 2 as the 3Hth upper key letter,- etc. 
1320 

The result is as follows: 



Cycle -9 



Cycle -13 
Cycle -17 



>303 


{3°7 


311 


£15 


319 


512 


316 


320 


524 


528 




6 


2 


D 


W 




¥ 


B 


Q 


G 


G P R A Q 


4 0 K I 


16 KOXSVZAK 


DDXZ 


>03 


R07 


311 


<315 


^19 


316 


320 


324 


328 


332 


7 


6 


2 


D 


¥ 


¥ 


B ; 


Q 


G 


H 


¥ L L C 


2AKI 


Y,R J 3 W ,S P Q> 


U 4 H J 


j3°3 


307 


311 


315 


319 


I320 


324 


328 


332 


336 


. G D A C 


I W S t? 


U U P s 


T Y 5 K| 


C 6 6 0 



We have been dealing so far with the first position letters 
in these sections of four letters, or as we shall term them the 
first elements of the periods . Let us now take up the second, 
third, and fourth elements of the periods, beginning, as’ before, 
with 7 as a base, that is, as the upper key' letter in loci i304, ' 305 , 

\ '317 ( 318 

and5306 in Cycle -13- Each set or series of letters i 3 entirely 

13 19 

independent of any other seti and that is why it is absolutely im- 
material with what letter a 3 a base each series is begun:, the ul- 
timate result, viz, the interaction of certain letters in Cycle -17 
will be the same regardless of the initial letter in each set of 
elements. The four reconstructed, and independent. series are as 
shown below, and the manner in which they interact" in the third mes- 
sage is also indicated. The result of applying the keys to the 
cipher letters is marked BASE. Of course, no 'plain te^t appears 
as yet. 
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Cycle -9 



Cycle -13 



/ Upper key 


loci 


303 




307 




311 




315 




319 






I Lower key 


loci 


312 




316 




320 




324 




328 






\ Upper key 


loci 


i 




6 R 


X 


C 2 S 


R 


G D V 


2 


Q ¥ Q 


D 


V 


> I Lower key 


loci 






¥ L 


L 


0 B D 


L 


U Q K 


E 


0 G 6 


H 


X 


' Cipher 


. X B 


C P R 


A 

i 


Q 4 0 


K 


P 6 H 


0 


X V z 


A 


EDI 


X 


z 


/Upper key 


loci 


303 


t 


307 




311 




315 




319 






\ Lower key 


loci 


316 


/ 


320 




324 




328 




332 






| Upper key 


loci 


7 7 


7 


7 6 R 


X 


C 2 S 


R 


G D V 


2 


Q W Q 


D 


V 


f Lower key 


loci 


¥ L 


L 


0 B D 


L 


U Q K 


E 


0 G 6 


H 


K H 5 


X 


Y 


\ Cipher 




¥ L 


L 


0 2 A 


K 


DYE 


J 


2 ¥ S 


P 


0 U 4 


H 


J 


/Upper key 


loci 


303 




307 




311 




'315 




319 






1 Lower key 


loci 


320 




324 




328 




332 




336 






\ Upper key 


loci 


7 7 


7 


7 6 R 


X 


C 2 S 


R 


G D V 


2 


Q ¥ Q 


D 


V' 


1 Lower key 


loci 


B D 


L 


U Q K 


E 


0 G 6 


H 


K H 5 


X 


Y 






\ Cipher 




G D 


A 


C I ¥ 


S 


U U U 


P 


2 T Y 


5 


KC 6 


6 


0 


BASE 


■* 


A 7 


Z 


d!r p 


B 


z;5 B 


4 


QlF H 


7 


F | 










C 


>> 


(4 


w 


0*7 









W© are ready now to try out various beginnings. As before , we 
will assume one beginning, keeping it constant, and trying all other 
beginnings with it. Let us assume Cycle -13 begins with ADJUTANT3 
GENERAL, and proceed to apply corrections for imperfect keys for 
Cycle -13 first. The upper keys for the first period of Cycle -17 
are unaffected by the plain text assumed. The lower keys are affected 
by the letters ADJUTANT. In the preceding section we corrected the 
keys by adding the progressive value of the plain text, and this * 
value was determined by adding the letters of the plain text in their 
direct sequence. But In this case, sincb the four N elements of the 
periods are Independent, we cannot apply merely the progressive 
value but must apply what shall be termed the PERIODIC PROGRESSIVE 
VALUE, found by adding in progressive manner every nth letter of 
the assumed plain text, n being the period. Or, put In .the form of 
an expression, the sign J /k Is understood to Indicate that the 
progressive value of every , fourth letter of the series Is to be 
taken.- For the first period of Cycle -17 the correction for imper- 
fect lower keys will therefore be the following; 



1s t pe riod 

r t ■ s'" i m — aMMw »aa»nMi» 

J/4 f Id j u 

T A N T 



This correction applied to the first period of the base gives 
the following; J 



Base 

Correction for im- 
perfect upper key 

Correction for Im- 
perfect lower key 



1st period 
A 7 Z D 




2nd period 
R P B Z 



3rd period 
5 B 4 Q 



-? 4 - 



First resultant 
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it 



The corrections for imperfect upper and lover keys for the 
second and third periods are as follows: 



Ppper 




2S<L 
U ^ pe r , key 




a d j u 





A D J U 
T AUT 

rm - 



/ A D J U 
J 4 T A N T 
3GEI 
E R A L 

nro 



these corrections are applied to the 



respective periods as follows: 



Base 

Correction for im-1 
perfect upper keyi 
Correction for im-, 
perfect lower key} 

First resultant 



1st period ' 


2nd period 


3rd period 


A 7 Z D 


R P B Z 
AD J U 


5 B 4 Q v 
W R U Q 


W R U Q 


Q T I 6 


P G S D 


T R P V 


VKHF 


G D R D 



Having determined the first resultant we are now ready to test 
all possible beginnings for Cycle -9» Let us proceed at once to 
the correct one, viz, C0MMANDING3GENERAL. The periodic progressive 
corrections are found as before, beginning with the letter I of 
COMMANDING since it is the first one to enter into the calculations, 
that Is j /4 ING3GENERAL Is to be taken. 



1st period 

Upper key 

— — — 




3rd period 

Lower key 



No correc- I N G 3 
tlon neces- 
sary 



I N G 3 




I N G 3 r 
GENE )4 

rm ' 



I N G 3 
GENE 
mTTT 




I N G 3 
GENE 
R A L 6 




These corrections are applied to the second resultant and yield 
intelligible plain text. Thus: 



. First resultant 
Correction for im-) 
perfect upper key| 
Correction for im-i 
perfect lower keyj 
Plain ^ext 




TR P V 




2nd period 

V K H F 
I N G 3 



3rd period 

G D R D 
M F P S 






-PING 




3 C 0 N 



All these steps may be simplified and summarized as shown 
below. It was necessary to go through all the steps above In order 
to show the mechanics of the process In detail. But if these steps 
be analyzed carefully, it will become apparent that certain repe- 
titions of plain text periods cancel out, being duplicates, so that 
the final result is achieved just as well by going through only 
the following steps: 



- 75 - 




REF ID :'A4148 948 



i 



1st period 




Base x 

Correction for plain) 
text of Cycle -13 J 
First resultant 
Correction for plain) 
text of Cycle -9 J 
Plain text for) 

Cycle -17 j 



A 7 Z D 
A D J U 
T AN T 



RPBZ 5 B 4 Q 
T A N T 3 G E I 
3 G E N ERAL 

fro 



ING3 GENE R A L 6 



PING 3 C 0 N T R 0 L 



No further comment Is necessary in regard to the rapidity of 
the process. Once Intelligible text Is found, new keys are con- 
structed employing the deciphered plain text and taking into account 
the fact that the periods consist of four Independent elements. 

The reconstructed keys will not be perfect keys, but they will 
operate in every case where the cycle Involved is four or a multiple 
of "four intervalsTawaiy from any~of "the cycles whlch^entered into 
their reconstruction. *" “ " " — 



C. (Case 3) -“The distance between the confirmative cycle and 
the nearer experimental cycle Is a multiple of the distance between 
the two experimental cycles. 



In the case just discussed, the cycles were equidistant. The 
process can be applied likewise to those cases in which the distance 
between the confirmative and the nearer experimental cycle Is a 
multiple of that between the two experimental cycles. The practical 
application of the method is dependent upon the same two factors 
as before, viz, the distance between the cycles, and the length 
of the plain text assumed. An example taken from the series of 
tes.t messages will serye our purposes. The messages have been 
arranged for decipherment: 



Upper key loci 
Lower key loci 
H.Y. 20 (Cycle -609) 



' 014 
623 

. . ' 1 VQVY43VG36 . . . Confirmative 



. Upper key loci 
Lower key loci 
HOB. 32 (Cycle -621) 



1 002 014 

623 , 635 

INT4S J0WCK73RS0FEY2HI07VPB . . . Experimental 



Upper key loci 
Lower key loci 
WASH. 13 (Cycle -624) 



002 ' 014 

626 638 

VCCSGUPWMUDY2NR02GHPIB . . . Experimental 



Hoboken 32, and Washington 13, the experimental cycles, are 
three cycles apart; while New York 20, the confirmative cycle, 
and Hoboken 32, the nearer experimental cycle, are twelye cycles 
apart; In other words, the distance between the first and second 
cycles Is the fourth multiple of that between the second and third. 

Let us reconstruct Imperfect keys employing the principles 
of peribdlcity just elucidated. The period, being the distance 
between the experimental cycles, is three. The keys, using X, Y, 
and Z as bases, are as follows: 



N.Y. 20, 
Cycle -609 



Upper key loci 
Lower key loci 
Cipher 



/ Upper key loci 
f Lower key : loci 
HOB „ 32 J- Upper key iloci 
Cycle -621 j Lower key 'loci 
' l Cipher : 



WASH. 13 
Cycle -624 



Upper key loci 
Lower key loci 
Upper key loci 
Lower key loci 
Cipher , - 
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014 
- 623 

. . .VQm3VG36 

002 014 

623 ' 635 

XYZXYT 0 JX J7HFM66PDARS 
FFKA 65 OKQC OEHDBKTZAHW 
! , 4SJ0WCK73RS0FEY2HX07VPB 

002 014 

626 638 

XYZXYT0JXJ7NFM66PD 
A 65 OKQC OEHDBKTZAHW 
l VCCSGUPWMUDY2UR 02GHPIB 



Applying to Hew York 20 upper keys 014 
we have the following :| 



and lower keys 623 



H. Y. 20 
Cycle -609 



'Upper key loci 
Lower key loci 
Upper key lbci 
1 Lower key loci 
■ Cipher 
Base' 



014 020 

623 629 

FM 66 PDARS 
PFKA 65 OKQ 
VQVY43VG3 
SIRFSLS5P 



> Let us assume for the plain text of Hoboken 32, STJRGEOI0GENERAL6 
H52WASHIHGT0H 9 and determine the first resultant. We must begin 
with the E of SURGE OH, since that is the first letter which enters 
into relations. / 1 



1 st period 



Hew York 20 

2 nd period 



E0 H 



3 G E 1 
HER. 
A L 6 
H'5 2 
V A 5 
H Y F 



Ho cor- 3 G E 

rection r HER 

necessary / 3 A L 6 

/ H 5 2 

W A 5 

. 55S 

m 



3 G E 



Base 

Correction for im-1 
perfect upper key? 
Correction for im-g. 

perfect lower key^ 
First resultant 



1 st period 
“ SIR 

U P L 

E 0 H 

A 4 H 



2 nd peri od 
“PS L 

H Y F 



B T 5 



?rd p eriod 

Hf 1 * 1 I H mw , . , 

S 5 P 
U R 4 

3 G E 
R K 5 



\- 

Let us now try as the assumed plain text of Washington 13 the 
correet beginning, DEPARTMEHT 3 AIR 3 SERVXCE . 



) 
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Hew York 20 



Upper key 





Upper key Lower key 




D E P 
ART 
MEN 
T 3 A 
I C D 



No correc-r 
tion necea-y- 
sary J 3 



D E P 
ART 
MEN 
T 3 A 
1 8 3 
T3F 



D E P 







D E P 
ART 
MEN 
• T 3 A 
I R 3 
S E R 
S’ S U 



^ D E P 
/ 3 ART 
' R'TT 



First resultant 
Correction for im-i 
perfect upper key) 
Correction for im-) 
perfect lower key) - 
Plain text 



1st period 


■2nd period 


3rd period 


A 4 H 


B T 5 


r rs 


I C D 


7 3 'p 


s s u 


_ - — 


D E P 


* R J I 


SIX 


T Y 3 


S E V 



The appearance of the words SIXTY3SEV . . . gives the beginning of 
excellent plain text. The keys are reconstructed and the decipher- 
ment continued . 



The short-cut, eliminating all details, for this process Is sum- 
marized below. The plain text letters are the summations of the 
letters In the columns. 

New York 20 



Base 



Assumed plain^ text 
for Hoboken 32 




Assumed plain text 7 
for Washington 13 J 



Plain text for New 
York 20 



1st period 


2nd period 


3rd period 


SIR 


F STL 


S3"7 


EON 


3 G E 


N E R 


3 GB 


N E R 


A L 6 


N E R 


A L 6 


N 5 2 


A L 6 


N 5 2 


W A 5 


N 5 2 .„ 


WA 5 


5 5S 


D E P 


ART 


Men 


ART 


MEN 


T 3 A 


MEN 


T 3 A 


I R 3 


T 3 A 


I R 3 


S E R 


SIX 


T Y 3 


S E V 



D. (Case 4) --The three cycles at irregular intervals. 

We have been leading up > step by 3tep v to the solution of the most 
Important case of all, viz, that in which no sequent cycles, or 
cycles at any regular distances apart are available. This case is, 
of course, the most valuable from the practical standpoint, and 
warrants restatement. It means that given two messages separated 
by 2, 3, 4, ... up to say 15 cycles, plain text may be assumed and 
tested upon any other cycle that may be available, providing only 
that the keys applying to this third cycle fall within the sections 
of assumed plain text. 

Let us study an actual example taken from the series of test 
messages. We shall choose ss^ the experimental cycles Hoboken 32 
and Washington 13, which are three cycles apart. For the confirmative 



- f 
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cycle we. shall take Washington 39- In the diagram below the mes- 
sages have been arranged for decipherment % imperfect keys have been 
constructed and applied to Washington 39. 



Hoboken 32 

Cycle -621 

Upper Key loci' 785 

Lower key loci 619 

Imperfect upper key 
Imperfect ■ lower .key , 

Cipher ' || N 1 

£ 

Washington 13 
Cycle -621 
Upper key loci 
Lower key loci 
Imperfect upper key 
Imperfect lower key 
Cipher 

Washington 39 (£svif‘) 

Cycle -631 
Upper key loci 
Lower key loci 
Imperfect upper key 
Imperfect lower key 
Cipher 

Base ' 

) 

Before we can proceed. It will be necessary to introduce into 
the discussion a feature which presents Itself here for the first 
time. ■v ‘ ' 

0 ' 1 

< / 

The distance between the two experimental cycles determines 
the period and the periodic length is simply the sum of the number 
of its constituent elements. As regards the upper key, the periods, 
and therefore all their constituent elements, for all cycles, 
coincide, since all of our analysis is based upon the fiction of 
a stationary longer .(supper) key. But as regards the lower key, 
which in our analysis is regarded as the moving key, any period In 
one experimental cycle has a homologous period in the other experi- 
mental cycle, both periods being composed naturally of the same 
elements and in the same order. In other words, the first, second, 
third . . . elements of a given period of one experimental cycle 
coincide with the first, second, third . . . elements of a homologous 
period of the other experimental cycle.. The case is somewhat 
analogous to that in wave motion, when two waves of similar period 
reach their maximum magnitude simultaneously, the two waves being 
in a condition termed as "in phase." 

How, in the case of three equidistant cycles, the lower key 
periods of the confirmative cycle are In phase with those of the 
experimental cycles. The same Is true of the case where the distance 
between the confirmative cycle and the nearer experimental cycle 
is a multiple of the distance between the two experimental cycles. 

But in the case which conforms to neither of these cases, that is, , 
where the distance between the confirmative cycle and the nearer 
experimental cycle is neither equal to nor a multiple of the dis- 
tance between the two experimental cycles, the lower key periods 
of the confirmative cycle are > not in phase with those of the. 



l 



1 4 s 



002 
623 

HZ 
P P K 
JOY 



I 



002 
626 
x y 

A 6 
Y C 



002 

$33 

x y 

0 E 
U D 



X Y T 

A 6 5 
Y C t 



X Y T 
0 K Q 
SOU 



X Y T 
D B 
6 5 K1 



2 X Kl K ¥ T! 



1 



0 J 
0 y K 
7 3 



R 



012 
633 
J 7 N 
COE 
SOP 



F M 6 6 P D 
OBIT 4 
B I 2 H I 0 



022 

OCA 



A R S 
A H ¥ 
7 V P 



n 

q n 

Bin 



012 
636 

J XI J 7 H|P M 616 P D 
I D B E T z| A H W| 
!U D Y 2 N R 0 



0 E 



022 

007 



2 G 



0 J 
T Z 
D X 



012 
004 
XI J 7 
A H ¥ Q 
RSA G 7| 



P M 6 
M A Q 
F L 6 



A R S 
Q M A 
H P I 



C T 
Q Z 
B E 



6 
Z ' 
A H 



P Dj 



E U Hi M D 6| M P Qg 



022 
014 
R S 



4 5 T 



C T 



79 - 



* * 



I 
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experimental cycles. The condition, to continue the analogy with 
wave motion, exhibits a "difference in phase"; and in this case, 
with a period of three, the difference is either l/3 or 2/3 of a 
period. That is, the periods of the confirmative cycle are either 
advanced or retarded l/3 or 2/3 of a period. When this Is the case, 
the application of imperfect keys derived from the two experimental 
cycles will not result in the production of intelligible text In 
the confirmative cycle unless a correction for the difference In 
phase is applied. The reason for this phenomenon IS obvious when 
one considers the origin of imperfect keys as contrasted with that 
of perfect keys. In reconstructed perfect keys, adjacent .letters 
of both the upper and the lower key bear a definite relation to '■ 
one another -“they are the individual successive links of a continuous 
single chain .which has been made^link by link^from the plain text<=*- 
cipher text relations. But imperfect keys that have been constructed 
from experimental cycles not directly sequent consist of several 
independent chains which "dovetail" 'in such a manner as to produce 
intelligible text only where the periods of the confirmative cycle 
are in phase with those of the experimental cycle. These chains 
are Independent because they are generated by independent, unrelated 
base letters. 

\ ■ » * ■ 

# 

The difference between keys of these two types is comparable 
to that between a single phase and a polyphase alternating current 
of electricity, and we have termed a key of the first type a 
MONOPHASE KEY, and one of the second type a POLYPHASE KEY. The 
difference between them may be shown diagrammstically in the follow- 
ing sketch: >' 



Monophase 
Polyphase , 




Difference in phase, in a polyphase key may be shown likewise 
in diagrammatic manner: 



l/3 phase difference (120°) 



,2/3 phase difference (2k 0°) 

) ' 

If, after a polyphase key has been constructed, we can establish a 
relationship between the letters or elements of It3 period (~ the 
phases of the period) , then the independent chains of the polyphase 
key may be merged and converted into one continuous chain which 
will then constitute a perfect monophase key. 

Let us proceed now to decipher the messages. For the . beginning 
of Hoboken 32 , one experimental cycle, we will. assume SURGE 0N3 
GENERAL6N52WASHINGT0N, The corrections to be applied are shown 
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below. The upp,er keys being constant , its periods are in phase 
throughout all cycles. The lower key periods of Washington 39 are 
out of phase with those of the experimental cycles, being retarded 
l/5 of a period. The elements of the periods of Washington 39 are 
in the order 2-3-1* instead of 1-2-3 because the first elements of 
the periods of Washington 39 are the second elements of those of 
the experimental cycles. For this reason the correction to be 
applied to Washington 39 takes the following form: 



Washington 39 



1st period 



5rd period 



Upper key 


Lower key 


Upper key 


Lower key 


Upper key 


Lower k 


No correc- 


2-3-1 


1-2-3 


2-3-1 


1-2-3 
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tion neces- 
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D T U 




5 2 W 
PLH 



4th period 

Upper key Lower key 



5th period 

Upper key Sower key 



I-2-3 


2 - 3-1 


3 G E 


• . 3 


HER 


GEN 


A L 6 


ERA 


nrr 


L 6 N 
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m 



1-2-3 

3 G E 
OR 
A L 6 
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TTTT 



2-3-1 

. . 3 



GEN 
ERA 
L 6 N 
5 2 W 
A 5 3 



5 S H 
RTF5 



Base 

Correction for ) 
imp. upper key) 
Correction for ) 
imp. lower key) 
1st resultant 



1st Per. 


2nd Per. 


3 rd Per. 


4th Per. 


5th Per 


2 X K 


E W T 


E U H 


M D 6 


H F Q • 


- - - 


3 G E 


4 6 J 


J D T 


U P L 


6 J J 
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R 4 5 


B P 3 


2 B P 


5 C J 


2 F T 


Z W G 



Let us assume for the beginning of Washington 13 the phrase 
DE P AR TMEIJT3 A IB 3 SERV I C E . The corrections are as follows: 
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1st period 

Upper key Lover key 



2nd period 

Lover key 

, , ¥f , , 



3rd period 

Upper - key Lover key 



Wo correc- 
tion neces- 
sary 



2 - 1-3 
. ; . D 
E P A 
R T M 

ULI 
K“R I 



1-2-3 
D E ? 



2-1-3 
. - . D 
E P 
R T 



A 



1-2-3 
D E P 
ART 

m 



Upper key Lover key 



2-1-3 
. . D 
E P A 
R T M 
EH 
3 A I 
R 3 S 
E R V 
S U 6 



ENT 
3 A I 
C~D~7 



5th period 

Upperkey ~"~ 



.2-1-3 
. . D. 
E P A 
R T M 
ENT 
3 A I 
R 3 s 
3 F S 




1-2-3 
D E P 
ART 
MEW 
T 3 A 
T“5~T5 



2-1-3 
. . D 
E P A 
R T M 
ENT 
3 A 

R 3 
E R 
I C 



i 

3 

V 

D 

T? 



Let us nov apply these corrections to the first resultant; 



1st Per. 


2nd Per. 


3rd Per. 


4th Per. 


5th F 
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D 



1st resultant 
Correction for 
imp. upper key^ 
Correction for 
imp. lover key] 
2nd resultant 



We are ready nov to apply the correction for difference in 
phase. Our imperfect polyphase keys consist of three independent 
chains, generated by the Initial letters X, Y,and 2. Let us design- 
ate by the letters k^, k 2 , 7 ;.and k-, those letters in perfect mono- 
phase keys which occupy the positions of, X, Y, and Z of our imperfect 
polyphase keys. Row k 2 and k^ are related insofar as k 2 is derived 
from k^ by means of the plain test-cipher relations vhich intervene; 
and kx is related to k 2 in the same manner. If ve could convert X 
into kit Y into k£ and Z into kj, our imperfect polyphase keys could 
be converted into perfect monophase keys. Wow-X plus an unknown 
Letter c^ would equal k^; Y plus an unknown letter c 2 , would equal 
■k 2 ; and Z plus an unknown letter c-z, would equal k^. These three 
unknown letters Ct\ c 2 , and c-j, which would constitute the correc- 
tions for phase difference, would repeat themselves periodically 
throughout the imperfect keys. We can transfer these relations 
directly to the second resultant. 



Second resultant - - W M 2 S Z 7 Z 4 4 . Z 7 Z HHD 

W plus the unknown letter would give the correct plain text 
for that locus; M plus eg would give the correct plain text letter 
for the second locus; and 2 plus c-z would give the correct plain 
text letter for the third locus. The cycle would repeat itself 
throughout the second resultant. . 
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Zj t c-^ = correct plain text for 1st letters of periods 



4? t Co - correct plain text for 2nd letters of periods 

H 7 J • 



4> + c-z =. correct plain text for 3rd letters of periods 

Z 

D* • . ‘ _ • 

The correction being constant for the three elements of the 
periods, we may set up the respective elements of these periods on 
the ordinary sliding alphabets, whereupon the correct plain text 
for each set of elements will appear on one generatrix which can ' 
be selected from all others by inspection, since it will be the 
one which contains the best assortment of high-frequency letters. 

The correct generatrix will be different for each set of 
elements, of course, but by selecting the most likely generatrices, 
the. corrected elements will now form Intelligible plain text. 

Thus : 
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Note that in the set-up of the first elements the Y generatrix 
is composed entirely of high-frequency letters, I T 5 3 E. In the 
set-up of the second elements the T generatrix is composed of high- 
frequency letters, 1 E 0 T 3- Uniting. the first and second elements 
in the third resultant we have the following: 



1 2 
12 3 12 

Third resultant: ¥ M 2 ,S Z 

Plain text; I H T E 



3 4 5 

3 1 23 123 123 

7 Z 4 4 Z 72 HHD 

' 3 0 3 T E 3 , 



In the set-up of the third elements the 3 generatrix is com- 
posed entirely of high-frequency letters, hut they do not combine 
well with the plain text found thus far. This generatrix when com- 
bined with the other two gives: ( - 



1 2 . - 3 
123 123. 123 

VMS S Z 7 Z 4 4 

III T E 3 301 
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Z 7 Z HHD 

3 T Y E 3 F 



The correct generatrix 

1 

1 2 
¥ M 
I H 



is the S generatrix. 

2 3 

3 12 3 12 3 

2 S Z 7 Z 4 : 4 

U T E S 3 0 F 



It gives the following: 

4 5 

,12 3 12 3 

Z 7 Z HHD 

. 3 T H' E 3 N 



In all subsequent cycles the correction for the difference in 
phase is the period Indicated by the generatrices determined above, 
viz, ITS. In other words =. Yj c 2 - T; c-^ - S. 



; For example, in Washington 68 the steps without going through 
the explanation above give the base shown below: 



Hoboken 32 
Cycle -621 Exp. 
upper key Toci 
Lower key loci 
Imp . upper key 
Imp. lower key 
Cipher N T 

Washington 13 
Cycle -624 Exp. 

U pperTcey loci 
Lower key loci 
Imp. upper key 
Imp . lower ' key i 

Cipher 

Washington, 68 
Cycle -638 Conf 
Upper key loci 
Lower key loci 
Imp. upper key 
Imp. lower key 
Cipher 
Base 



002 
623 
X Y Z 
P F Ki 
S J 0 V|V 



. 002 ' 
626 
X Y. Z 
A 6 5 
V C C 



002 
001 , 
X Y 
Z A 
L H 
V R 



XYT 
A 6 5 
C K 



Y T 
K Q 
G U 



XYT 
VQI 
T 7 E 
V 2 F 



012 
633 
0 J X J 7 N 
0 K Q C 0 E 
7 3 R S 0 F 



,012 
636 
0 J X J 7 N 
C 0 EE D B 
P W MU D Y 
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I 0 |7 V P 



016 
001 
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6 P D 
A H W 
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C T 
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6 P D 
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007 
R S 
M A 
P I 
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Q Z 
B E 
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021 
|A R S 



Z D T 
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C T 
R 
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